Re:Cluster of 295 Chrome extensions caught hijacking Google ...
by kevingadd on Thursday August 06, 2020 @02:55PM
(#24074220)
I agree with your perspective that the extension signing model is user-hostile, but under no circumstances should a signed extension be loading remote code, even if it's google translate. Maybe if the remote code is also signed and you're asserting that it matches a SHA256 hash... but at that point just bundle it into your extension.
If you allow loading remote code into an extension there's no point in signing or review or any other security measures because the extension is just malware waiting to happen.
If you absolutely must load remote code, load it in the page context where it doesn't have access to dangerous extension-only APIs. This is my PoV as someone who maintained a 100k-weekly-user Chrome extension for 3 years: I hate the Chrome Web Store but the 'no remote code' policy is correct and Mozilla is correct to also enforce it.
If you allow loading remote code into an extension there's no point in signing or review or any other security measures because the extension is just malware waiting to happen.
If you absolutely must load remote code, load it in the page context where it doesn't have access to dangerous extension-only APIs. This is my PoV as someone who maintained a 100k-weekly-user Chrome extension for 3 years: I hate the Chrome Web Store but the 'no remote code' policy is correct and Mozilla is correct to also enforce it.