ChromeGalvanizer – Harden your browser against extension backdoors and exploits

Re:ChromeGalvanizer – Harden your browser against extension ... by dsun179 on Saturday May 16, 2020 @06:23PM (#23207686)

This sounds great, I will try. Is it somehow possible to restrict the internet access of a single extension? For example I have an add-http-header extension that has no reason to create connection to an outside server.

[ Parent | on HN ]

Re:ChromeGalvanizer – Harden your browser against extension ... by gnicholas on Saturday May 16, 2020 @06:47PM (#23207846)

Not sure if this answers your specific question, but you can limit the sites that an extension can run on. I recently discovered that Chrome offers this feature (right click the extension icon and select Manage Extension to access), and it saved me from having to build a site whitelist feature for my extension. [1] It already has a blacklist feature, and I was going to build a whitelist feature due to user requests. Then I discovered that this functionality is built into all Chrome extensions.

Unfortunately it doesn’t seem to exist on Firefox.

1: https://chrome.google.com/webstore/detail/beeline-reader/ifj...

[ Parent | on HN ]

Re:ChromeGalvanizer – Harden your browser against extension ... by Thorrez on Saturday May 16, 2020 @07:48PM (#23208170)

If it can modify the DOM or even display its own HTML-based UI, that might be hard because it can embed an external image, and the loading of that image would contact an external website.

[ Parent | on HN ]