auditing-browser-extension-trust

Auditing browser extension trust: what another page can reach through the extension

A browser extension is dangerous where a web page it does not trust, or another installed extension, can drive one of its privileged capabilities: a host-scoped fetch that carries the user's cookies, a chrome-namespace API, or a DOM write in a content script that runs with the extension's reach. The bug is almost always a message boundary that verifies too little: an external handler that checks the calling domain but not that a trusted script is calling, or a content-script-to-background channel that trusts any sender. You audit it by resolving, per privileged sink, whether every path that reaches it validates the sender identity and origin and whether the permission it uses is scoped to what the extension needs. Stay on the extension's trust boundary; the web-page DOM sink taxonomy belongs to the client-side DOM skill.

When to use

• You are reviewing a browser-extension manifest, its background service worker, and its content scripts.
• The extension exposes an external message handler, a cross-context channel, or web-accessible resources.
• You want to know what an untrusted page or extension can reach through the extension's privileges.

Scope check

Audit only extensions you own or are authorized to assess, and drive a message boundary only against an extension and profile in scope, a privileged handler acts on the real browser session. Adjudicate on the manifest and the handlers. If you can't name the authorization, stop.

The loop

1. Resolve the permission scope and the sender checks first. Read the manifest for host permissions (a broad all-urls match versus an activeTab or a narrow host list) and for the external-connection surface, and read each message handler for what it validates about the sender. A privileged sink is only an attack surface when an untrusted caller can reach it and the permission it uses is broad enough to matter, so settle both before flagging.