Advertisement

A Framework for Analysing the Security of Chrome Extensions

  • V. AravindEmail author
  • M. Sethumadhavan
Conference paper
Part of the Smart Innovation, Systems and Technologies book series (SIST, volume 28)

Abstract

Google Chrome, the most popular web browser today, allows users to extend its functionality by means of extensions available in its own store or any third party website. Users can also develop their own extensions easily and add them to their browser. Vulnerabilities in browser extensions could be exploited by malicious websites to gain access to sensitive user data or to attack another website. A browser extension can also turn malicious and attack a website or steal user data. This paper proposes a framework which can be used by users and developers to analyse Chrome extensions. The technique presented here uses the permissions feature of chrome extensions and the flow of data through the extension’s JavaScript code to detect vulnerabilities in extensions and to check whether the extension could be malicious.

Keywords

Remote Server Security Vulnerability Static Analysis Tool Extension Core Extension Security 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Barth, A., Felt, A.P., Saxena, P., Boodman, A.: Protecting Browsers from Extension Vulnerabilities. In: Proceedings of the 17th Network and Distributed System Security Symposium (2010)Google Scholar
  2. 2.
    Carlini, N., Felt, A.P., Wagner, D.: An evaluation of the google chrome extension security architecture. In: Proceedings of the 21st USENIX Conference on Security (2012)Google Scholar
  3. 3.
    Liu, L., Zhang, X., Yan, G., Chen, S.: Chrome Extensions: Threat Analysis and Countermeasures. In: Proceedings of the 19th Annual Network & Distributed System Security Symposium (2012)Google Scholar
  4. 4.
    Bandhakavi, S., King, S.T., Madhusudan, P., Winslett, M.: VEX: Vetting Browser Extensions For Security Vulnerabilities. In: Proceedings of the 19th USENIX Security Symposium (2010)Google Scholar
  5. 5.
    Chrome Extension Developer Guide, http://developer.chrome.com/extensions

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  1. 1.TIFAC Core in Cyber SecurityAmrita Vishwa VidyapeethamCoimbatoreIndia

Personalised recommendations