25% of tested Google Chrome extensions allow data theft

27 of a 100 tested Google Chrome extensions have been found vulnerable to data (passwords, history, etc.) extraction attacks though specially crafted malicious websites or by attackers on public WiFi networks.

A trio of security researchers have manually analyzed 50 of the most popular Chrome extensions and added to that list 50 more chosen by random.

“We looked for JavaScript injection vulnerabilities in the cores of the extensions (the background, popup, and options pages); script injection into a core allows the complete takeover of an extension,” explained Adrienne Porter Felt, one of the researchers. To prove their claim, they performed PoC attacks devised to take advantage of the vulnerabilities.

The bad news is that over 25 percent of the tested extensions were found to be vulnerable, and among them are seven that are used by over 300,000 users.

But, there’s also good news: 49 of the 51 vulnerabilities found can be patched by simply adapting the extensions to use one of two offered Content Security Policies (CSP).

These Policies prevent a successful injection of malicious JavaScript code in various ways: by banning the use of the eval function so that untrusted data doesn’t get executed as code; by moving legitimate JavaScript to a .js file so that when malicious scripts are injected they are immediately differentiated from the legitimate ones and recognized for what they are; and by completely or partially disallowing external scripts altogether.

“In addition to core extension bugs, extensions can add vulnerabilities to web sites,” points out Porter Felt. “CSP will not prevent this, but developers should remember not to use innerHTML to modify web sites. Instead, use innerText or DOM methods like appendChild. Extensions also shouldn’t add HTTP scripts or CSS to HTTPS web sites.”