Skip to main content

27% of tested Google Chrome extensions allow data theft

posted onSeptember 30, 2011
by l33tdawg

27 of a 100 tested Google Chrome extensions have been found vulnerable to data (passwords, history, etc.) extraction attacks though specially crafted malicious websites or by attackers on public WiFi networks.

A trio of security researchers have manually analyzed 50 of the most popular Chrome extensions and added to that list 50 more chosen by random.

"We looked for JavaScript injection vulnerabilities in the cores of the extensions (the background, popup, and options pages); script injection into a core allows the complete takeover of an extension," explained Adrienne Porter Felt, one of the researchers. To prove their claim, they performed PoC attacks devised to take advantage of the vulnerabilities.

Source

Tags

Google Chrome Security

You May Also Like

Recent News

Tuesday, November 19th

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th