News for hackers. Stuff that matters.

A comment on Chrome extensions are tampering with security headers. Parent comment

Re:Chrome extensions are tampering with security headers by kid-icarus on Tuesday May 25, 2021 @09:55PM (#27285247)
Yes, if an extension can override CSP directives to allow arbitrary connect-src exceptions, it effectively means that any data in any form on any page is now susceptible of having that data sent to an attacker-owned URL.

The solution doesn't necessitate removing extensions, it just means potentially constraining the API surface of extensions in order to mitigate the attack surface.

[ Parent | on HN ]
Re:Chrome extensions are tampering with security headers by postalrat on Wednesday May 26, 2021 @01:10AM (#27286622)
Extensions don't need to modify headers to view anything in the dom or make requests with the credentials of the page it's running in. The only thing it can't do is directly interact with the javascript running on the page (and vise versa).
[ Parent | on HN ]
Re:Chrome extensions are tampering with security headers by rini17 on Wednesday May 26, 2021 @07:45PM (#27297587)
This is misunderstanding. Extensions can read any data even with restrictive CSP. Malicious extension then can use other channel than the currently opened tab to exfiltrate them. There are many.

Extension users do want the extensions to interact with pages, often including cross-origin requests. That is what extensions are for and they won't work with restricting API surface.

[ Parent | on HN ]