News for hackers. Stuff that matters.

A comment on Chrome extensions are tampering with security headers. Parent comment

Re:Chrome extensions are tampering with security headers by jay_kyburz on Tuesday May 25, 2021 @09:59PM (#27285281)
A script loaded by a site needs to escape its sandbox. I assume an extension script is not in its own sandbox so it can read you banking details when you visit a banking website. I imagine they can read key presses so an extension can know your banking passwords.
[ Parent | on HN ]
Re:Chrome extensions are tampering with security headers by hungryfoolish on Wednesday May 26, 2021 @02:02AM (#27286915)
Which is why extensions also nowadays only served via a web store which has moderation policies and moderators which look for this kind of stuff.
[ Parent | on HN ]
Re:Chrome extensions are tampering with security headers by ocdtrekkie on Wednesday May 26, 2021 @10:29AM (#27290907)
The Chrome Web Store is functionally a malware distribution system. There's no real moderation to speak of, and the vast majority of desktop PC malware is distributed by it.
[ Parent | on HN ]