Attributed metadata history
Up to 100 retained publisher events per page for 804bc8d74fbf57aa01fb66175df80bf7fcb31985eea443bec54d39431d9ee867. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_ad89769b9e64591ab5
observed · 2026-10-12 14:01:03 UTC
available
Fingerprint: 05d146f940ea021a0ff67bda626eeffcdf1f2ccbc0f3c3114fff19b0a80eeaf4
intelligence_src_ad89769b9e64591ab5
observed · 2026-10-12 14:01:03 UTC
As noted last week I consider it highly problematic that Google for a long time allowed extensions to run code they downloaded from some web server, an approach that Mozilla prohibited long before Google even introduced extensions to their browser. For years this has been an easy way for malicious extensions to hide their functionality. When Google finally changed their mind, it wasn’t in form of a policy but rather a technical change introduced with Manifest V3. As with most things about Manifest V3, these changes are meant for well-behaving extensions where they in fact improve security. As readers of this blog probably know, those who want to find loopholes will find them: I’ve already written about the Honey extension bundling its own JavaScript interpreter and malicious extensions essentially creating their own programming language. This article looks into more approaches I found used by malicious extensions in Chrome Web Store. And maybe Google will decide to prohibit remote code as a policy after all. Update (2025-01-20): Added two extensions to the bonus section. Also indicated in the tables which extensions are currently featured in Chrome Web Store. Update (2025-01-
Fingerprint: 03f4f08e713d559414083b7321518c63d9303ae85efe02cd845194be82ca86df