News for hackers. Stuff that matters.

A comment on More malicious extensions in Chrome Web Store. Parent comment

Re:More malicious extensions in Chrome Web Store by londons_explore on Thursday June 01, 2023 @06:03AM (#36149211)
Thing is, you can't load javascript code... But you can easily write a mini virtual machine to run any code you download from the web. And due to javascripts introspection abilities, that VM can (if the developer wishes) do anything.

The simplest javascript bytecode interpreter is probably only a few hundred bytes, which is easy to hide in a big extension.

[ Parent | on HN ]
Re:More malicious extensions in Chrome Web Store by rektide on Thursday June 01, 2023 @01:14PM (#36154246)
Those sidesteppings are outlawed by the Chrome Web Store policies.

There are JS-in-JS interpreters out there. They're just not allowed. https://github.com/jterrace/js.js/ https://github.com/marten-de-vries/evaljs

[ Parent | on HN ]