News for hackers. Stuff that matters.

A comment on More malicious extensions in Chrome Web Store.

Re:More malicious extensions in Chrome Web Store by lewantmontreal on Wednesday May 31, 2023 @11:57PM (#36147424)
Wasn’t manifest v3 supposed to prevent dynamically loaded code? As the article says these extensions are featured but (I think) the latest update to v3 says: “In January 2023, use of Manifest V3 will become a prerequisite for the Featured badge in the Chrome Web Store.”

https://chromeos.dev/en/posts/manifest-v-3-migration-timelin...

[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by mnoorenberghe on Thursday June 01, 2023 @12:24AM (#36147556)
Google announced on December 9 that this timeline was paused: https://groups.google.com/a/chromium.org/g/chromium-extensio...
[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by palant on Thursday June 01, 2023 @01:20AM (#36147825)
Note: I am the author of this article.

Migration to Manifest V3 has been postponed, all these extensions (like most extensions in Chrome Web Store) are using Manifest V2.

Note that the changes in Manifest V3 are meant to prevent security vulnerabilities. Outright malicious extensions will always find a way.

[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by palant on Friday June 02, 2023 @04:10PM (#36170116)
As I said, outright malicious extensions will always find a way. I now discovered a newer variant of these extensions, this time using Manifest V3. And they still run arbitrary code: https://palant.info/2023/06/02/how-malicious-extensions-hide...
[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by rektide on Thursday June 01, 2023 @01:26AM (#36147853)
Yes, dynamic code is all outlawed.

Disclaimer, I filed this issue. https://github.com/w3c/webextensions/issues/139

[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by londons_explore on Thursday June 01, 2023 @06:03AM (#36149211)
Thing is, you can't load javascript code... But you can easily write a mini virtual machine to run any code you download from the web. And due to javascripts introspection abilities, that VM can (if the developer wishes) do anything.

The simplest javascript bytecode interpreter is probably only a few hundred bytes, which is easy to hide in a big extension.

[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by rektide on Thursday June 01, 2023 @01:14PM (#36154246)
Those sidesteppings are outlawed by the Chrome Web Store policies.

There are JS-in-JS interpreters out there. They're just not allowed. https://github.com/jterrace/js.js/ https://github.com/marten-de-vries/evaljs

[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by aa_is_op on Thursday June 01, 2023 @05:21AM (#36148969)
No. Manifest v3's main role was to cripple ad blockers... hence you're now seeing YouTube experiment with "anti-ad-blocker" popups warning users they wouldn't able to see the site.

They know they got people by the balls after they rolled out v3 earlier this year.

[ Parent | on HN ]