[Paper Review] EmPoWeb: Empowering Web Applications with Browser Extensions

Dolière Francis Somé|arXiv (Cornell University)|Jan 10, 2019

Web Application Security VulnerabilitiesComputer Science24 references39 citations

TL;DR

This paper presents a large-scale static analysis of browser extension communication interfaces in Chrome, Firefox, and Opera, revealing that 197 extensions can be exploited by malicious web applications to bypass the Same Origin Policy, access sensitive user data (cookies, browsing history, bookmarks), and download arbitrary files. The study identifies critical security flaws in message-passing mechanisms and proposes enhanced review processes and architectural changes to mitigate these threats.

ABSTRACT

Browser extensions are third party programs, tightly integrated to browsers, where they execute with elevated privileges in order to provide users with additional functionalities. Unlike web applications, extensions are not subject to the Same Origin Policy (SOP) and therefore can read and write user data on any web application. They also have access to sensitive user information including browsing history, bookmarks, cookies and list of installed extensions. Extensions have a permanent storage in which they can store data and can trigger the download of arbitrary files on the user's device. For security reasons, browser extensions and web applications are executed in separate contexts. Nonetheless, in all major browsers, extensions and web applications can interact by exchanging messages. Through these communication channels, a web application can exploit extension privileged capabilities and thereby access and exfiltrate sensitive user information. In this work, we analyzed the communication interfaces exposed to web applications by Chrome, Firefox and Opera browser extensions. As a result, we identified many extensions that web applications can exploit to access privileged capabilities. Through extensions' APIS, web applications can bypass SOP, access user cookies, browsing history, bookmarks, list of installed extensions, extensions storage, and download arbitrary files on the user's device. Our results demonstrate that the communications between browser extensions and web applications pose serious security and privacy threats to browsers, web applications and more importantly to users. We discuss countermeasures and proposals, and believe that our study and in particular the tool we used to detect and exploit these threats, can be used as part of extensions review process by browser vendors to help them identify and fix the aforementioned problems in extensions.

Motivation & Objective

• To investigate the security and privacy risks posed by message-passing interfaces between browser extensions and web applications.
• To identify extensions in the wild that can be exploited by web applications to gain privileged access to user data.
• To evaluate the feasibility of large-scale static analysis in detecting such vulnerabilities across major browsers.
• To propose actionable countermeasures for browser vendors to improve extension review processes and secure message-passing mechanisms.

Proposed method

• Developed a static analyzer to examine message-passing interfaces exposed by extensions in Chrome, Firefox, and Opera.
• Analyzed 66,401 Chrome, 9,391 Firefox, and 2,523 Opera extensions for potential exposure of privileged capabilities.
• Flagged extensions as suspicious if their message-passing interfaces could allow web applications to access sensitive data or execute privileged operations.
• Manually reviewed a subset of flagged extensions to confirm exploitable vulnerabilities.
• Evaluated the impact of these vulnerabilities through proof-of-concept demonstrations and threat modeling.
• Proposed architectural changes to restrict message reception to only code injected by extensions, enhancing trust boundaries.

Experimental results

Research questions

• RQ1 Which browser extensions expose message-passing interfaces that can be abused by web applications to access privileged browser features?
• RQ2 To what extent do existing extension review processes fail to detect extensions that can be exploited to exfiltrate user data?
• RQ3 Can static analysis effectively identify large-scale security flaws in extension-web application communication channels?
• RQ4 What are the real-world impacts of such vulnerabilities in terms of data leakage and privilege escalation?
• RQ5 How can browser vendors and extension developers mitigate these threats through improved design and review processes?

Key findings

• 197 extensions across Chrome, Firefox, and Opera were confirmed as vulnerable to exploitation by web applications through insecure message-passing interfaces.
• Approximately 4.97% of Chrome, 5.14% of Firefox, and 8.48% of Opera extensions were flagged as suspicious by the static analyzer.
• Malicious web applications can bypass the Same Origin Policy and access user data on any web application via vulnerable extensions.
• Extensions were found to leak sensitive information such as cookies, browsing history, bookmarks, and the list of installed extensions.
• Web applications could trigger arbitrary file downloads and store data in extension persistent storage for tracking purposes.
• Browser vendors, including Firefox and Opera, have taken action by removing or discussing fixes for the reported extensions, validating the real-world impact of the findings.