Skip to main content

Browser Extension Security

Extensions, while enhancing browser functionality, pose significant security risks—acting as vectors for malware, unauthorized access, and data leakage—if not properly managed. Browser extension security is an impactful but often-overlooked risk. This document provides a comprehensive understanding of browser extension security and how Keep Aware addresses its challenges—from visibility and context to management and restriction.

Fundamentals of Extension Security​

Browser extensions are add-ons or plugins that enhance the functionality of a web browser by adding features or integrating with other applications. From a risk and security perspective, extensions are additional software integrated directly into the browser. Even though these add-ons are code running in an organization's digital ecosystem, many companies are unaware of this risk vector and thus unknowingly accept the risks of unmanaged extensions.

Risks of Unmanaged Add-Ons​

Because browser add-ons are often overlooked and unmanaged, threat actors target this attack vector by distributing malicious extensions—which often trojanize legitimate functionality to stay under the radar—through websites and legitimate browser stores. Malicious extensions can go so far as to harvest personal and business data and even read and manipulate web content on any tab. Additionally, employees installing unmanaged add-ons create additional risks derived from shadow IT and outdated, or vulnerable, extensions.

Basic Principles​

  • Visibility: See browser add-ons and their details across the organization. The core of extension security.
  • Management: The ability to enforce relevant policies.
  • Restriction and Uninstallation: Prevent and remove extensions from a central location.

Common Scenario​

  1. An employee searches their browser's web store and installs an extension (e.g., an extension for ChatGPT).
  2. The browser add-on now has permissions to read web content and read cookies. It proceeds to harvest data and steal cookies of active web sessions.
  3. Because extensions are not managed, this risky add-on goes unnoticed and remains on the user's browser.
  4. Using the data and cookies stolen earlier, the extension continues subsequent attacks, such as installing a backdoor with admin permissions and hijacking certain online business accounts.

Variations​

Additional ways extensions can sneak into an environment or present organizational risk include:

  • Malicious, Browser Store: Employee installs trojanized extension from browser store.
  • Malicious, Drive-By: Employee installs malicious extension in a drive-by download.
  • Malicious, Compromised Site: Employee installs malicious extension on a trusted but compromised site.
  • Legitimate, Supply Chain Compromise: Employee installs legitimate extension but its supply chain has been compromised and updates are not to be trusted.
  • Legitimate, Vulnerable: Employee installs legitimate extension but the specific version has a known vulnerability and possibly a public proof-of-concept (PoC) attack.

Context and Background​

Since the late '90s, extensions have been enhancing and personalizing users' browser experiences. Browser web stores—the main channel through which add-ons are downloaded—each maintain a repository of compatible extensions. As computers, browsers, and extensions became widespread, so did their potential for misuse.

Current Landscape​

Today, the landscape of browser extensions is vast and varied, with over 200,000 of extensions available across different browsers. This diversity, while beneficial for functionality and for user experience, also presents significant security challenges, including shadow IT, unintentional data leakage, and potential malware distribution.

To decrease the chance of installing a malicious extension, best practices propose that add-ons are downloaded either from trusted third-parties or directly from the browser's web store. However, users continue to fall victim to drive-by download attacks.

Additionally, because so many extensions are submitted to each store and because threat actors use techniques to obfuscate their malintent or to operate 'under the radar', browser stores struggle to identify and reject malicious extensions. And, even if a malintent add-on is approved and hosted in an official store, subsequent updates can sneak in malicious functionality.

Real-World Examples​

Though browser extensions are pieces of third-party code running in an organization and should be treated as such, many teams struggle to manage add-ons or are altogether unaware of their risks.

Given the widespread disregard of browser extension risks in both personal and business settings, expect malicious add-ons to continue to be a pervasive threat.

Detailed Explanation of Extensions​

Components​

Core components to understand about a browser add-on include:

  • Browser Store: Each browser (e.g., Chrome, Firefox) have their own browser store, which offers a central location to download and install add-ons. Each store performs security checks on new extensions and on major updates.
  • Manifest File: Required for each extension. The manifest file provides high-level information about the extension, including version and permissions, and it lists content scripts and background scripts.
    • Permissions: Each extension requests permissions to perform various activities, such as reading clipboard, taking screenshots, reading or modifying web content.
    • Host Permissions: Specifies which web pages and protocols the extension is allowed to interact with.
    • Update URL: States where the extension retrieves its updates.
  • Content Scripts: Parts of the extension code that load and execute JavaScript or CSS within a web page and interact with the page's DOM.
  • Background Scripts: Parts of the extension code that run in the background, managing tasks like handling browser events and communicating with remote servers.
  • Document Object Model (DOM): The tree-like structure of a given web page and all of its HTML and JavaScript elements. Also referred to as the "DOM tree". When a JavaScript script is reading and/or manipulating the web page, it is interacting with the page's DOM tree.

Risky Indicators​

Extensions can present a wide range of risks—from shadow IT to malintent. Indicators of risk include:

  • Non-Browser Store Downloads: Is installed through means other than the browser's official web store. This can indicate malintent.
  • Drive-By Downloads: Is installed through the use of social engineering. This indicates malintent.
  • Abnormal Install: Was installed using admin permissions or through any means other than a normal install, such as sideloading.
  • Uncommon Add-On: The extension itself may be uncommon in an organization's environment. This usually indicates shadow IT or a potential malicious add-on.
  • Trojanized: Contains legitimate and benign functionality in addition to malicious code. Malicious extensions in browser stores are trojanized to bypass browser store security checks and to appear legitimate to users.
  • Overly-permissive: Requests a statistically high number of permissions and/or requests more permissions than is required for its advertised functionality. This could indicate the add-on has been trojanized.
  • Uncommon Permissions: Requests permissions that are statistically uncommon. This could indicate the add-on has been trojanized.
  • Risky Communications: Communicates with domains that are either parked, expired, and/or have a reputation for browser-hijacking or other risky activity. This indicates either end-of-life support or malintent.
  • Third-Party Updates: Updates are retrieved from a location other than the browser's official web store. If the third party is not a trusted entity, this presents the risk of future updates with malware.

Challenges and Considerations​

Common Issues​

  • Lack of Visibility: Users and administrators often lack clear insight and context into the activities of installed extensions.
  • Human Error: Often considered the weakest link in cybersecurity, users still fall for social engineering attacks and install unapproved extensions.
  • Lack of Domain Expertise: Analyzing the risks and potential impacts of extension manifest files, JavaScript code, and DOM tree manipulation requires expertise that may be difficult to attain when an organizations' human resources are constrained.

Solutions and Mitigations​

  • Regular Audits and Monitoring: Utilizing tools for continuous review and monitoring of extensions to detect and mitigate risks.
  • User Education: Regular awareness programs to educate users about the risks associated with extensions and how to manage them safely.
  • Comprehensive Tools: Leveraging tools with deep visibility, contextual insight, and out-of-box capability to guide your team to detect, prevent, and manage extensions from a central location.

The Keep Aware Advantage​

Attackers continue using ‘under the radar’ strategies to distribute malintent extensions, users carry on installing add-ons without understanding their risks, and organizations often lack visibility to address either issue. From deep visibility to centralized management and out-of-box capabilities, Keep Aware empowers your team to secure the browser and reduce browser risks.

High Level​

Keep Aware offers robust add-on management functionalities to reduce risk. Our solution includes:

  • Deep Visibility, Extension Insights: With a deep level of visibility into browser activities, Keep Aware provides real-time insights into extensions and surrounding activities.
  • User Training: Customizable notices to educate users on browser extension safety and to report suspicious web pages and extensions.
  • Comprehensive Extension Management: Centralized control over extensions, out-of-box detection suite, and proprietary risk scoring empowers your team to rapidly address and reduce risks of browser add-ons.

Technical Level​

Additional technical capabilities include:

  • Insight into extensions across your organization.
  • Inspecting extensions and their manifest file, including name, version, description, permissions, host permissions, homepage URL, update URL.
  • Insight into contextual information, such as web activity leading up to install, install type, if the add-on is enabled or disabled, number of installs in your organization, and number of public installs.
  • Central management of browser add-ons.
  • Real-time detections and prevention of extension installations that meet or do not meet certain characteristics.
  • Ability to force uninstall add-ons from a central location.
  • Proprietary risk score empowers your team to rapidly identify risky extensions.
  • Out-of-box detections for and protections against risky extensions.
  • Safeguards—or, user and browser protections—that are customizable and can be used for user education.
  • A Best Practices Feed with foundational and high-fidelity detections to rapidly reduce risks that can lead to unwanted and malicious extension installs.

Summary​

Browser extensions, while beneficial, pose significant security risks if not properly managed. By understanding the principles of extension security and implementing robust management and restriction mechanisms, organizations can protect their data and users. Keep Aware offers advanced tools and capabilities to address these challenges effectively.

To rapidly enhance your organization's browser defenses, apply Policies of category "extensions" to user and browser Profiles and/or subscribe Profiles to Best Practices Feed.

Further Reading on Extensions and Shadow IT​

Begin investigating and managing your organization's shadow IT by visiting the Catalog page and referring to our Catalog documentation.

References​

Further Reading​

Table of Contents