I crafted malicious Chrome extension: overhaul doesn’t mean you’re safe

Chrome will make huge changes to how the extensions work in June, hoping to improve performance and security. However, it may result in some useful extensions, such as adblockers, being impaired, leaving users vulnerable to trackers online. Extensions will remain largely unsafe overall, with large language models spitting out malware in seconds.

Even I, a non-programmer, managed to create a few Chrome extensions that could easily be turned malicious on the new Google platform, which is supposed to be safer. And it was highly disturbing.

Firstly, I just asked ChatGPT for an extension that lists some private user data. I started with cookies – there were no problems. The provided code worked, and the extension dumped all my cookies right in front of me.

I repeated the experiment to create different extensions for listing users' web browsing history, IP/location, or other information. Only some more complex ones, such as the keylogger, did not work immediately because of errors in the code.

Then, I asked the AI assistant to add functionality to the extension so it could beam the collected data to a different server. Also, there's no problem there. Here’s the code. Copilot is ready to provide a helping hand.

Browsing history, cookies, screenshots of tabs, page traffic, input and clipboard capturing, keystrokes, and mouse movements are all low–hanging fruit that Chrome extensions can obtain, according to Matt Frisbie, a software engineer and the author of buildingbrowserextensions.com.

“With a content script running on every page, reading keystrokes is dead easy,” he said.

If a user loses his cookies together with other data, malicious actors can hijack sessions without the need for passwords or multi-factor authentication.

Other types of malicious extensions could bombard users with notifications, urging them to visit a malicious website. While the extension cannot directly execute external code, it can still try to social engineer the user into downloading and running a malicious payload.

Someone nefarious could do much more on the platform, which rolls out in June and is supposed to make users safer.

And here is what Google itself says about the extensions:

“Extensions have access to special privileges within the browser, making them an appealing target for attackers. If an extension is compromised, every user of that extension becomes vulnerable to malicious and unwanted intrusion.”

A big change is coming, and problems remain

Starting in June, Chrome starts deprecating the older extension platform, Manifest V2, pushing developers to move to MV3. At first, MV2 will be disabled in pre-stable versions. The update will then finally roll out to stable Chrome 127 and later. The current latest Chrome version is 124.

A weekly updated Chrome version for Developers (pre-beta development stage) already warns users that some extensions may soon no longer be supported and users should remove or replace them with similar extensions from the Chrome Web Store. Ironically, Google Translate or extensions made by other tech giants still run on MV2.

“We expect it will take at least a month to observe and stabilize the changes in pre-stable before expanding the rollout to stable channel Chrome where it will also gradually roll out over time,” the latest timeline reads.

Manifest V3 is designed to enhance security, privacy, and performance by reducing the potential attack surface and implementing stricter permissions and policies.

However, my attempts to craft malicious MV3 extensions with large language models pale in comparison to Frisbie’s “Spy Extension,” which includes all the available permissions and demonstrates how extensions could be used to secretly steal everything possible, including data from inputs such as auto-filled information from password managers, clipboard data, precise geolocation, or bookmarks.

“Manifest V3 may have taken some of the juice out of browser extensions, but I think there is still plenty left in the tank,” said Frisbie.

He discovered that Chrome only prompts users for all required permissions once, at install time, and the pop-up window only reveals the first five permissions. For comparison, both Android and iOS prompt users separately for each permission app requires, making users more aware of what they are allowing.

“The most important security change in Manifest V3 is disabling remote code execution, and in this sense, it is very successful. I filed a bug report for the scrolling issue, and to my knowledge, it has not been addressed,” Frisbie told Cybernews.

Adblocking affected

Adblockers are particularly affected by the change. According to the GitHub wiki for uBlock Origin Lite, the transition to Manifest V3 cripples certain filtering capabilities, such as dynamic filtering, filtering based on response headers, and many regex-based filters. Some filtering capabilities cannot be enforced by default without requiring broad permissions, and filter lists no longer automatically update.

In Manifest V2, extensions have long-running background scripts that run in an environment independent of any other window or tab. Powerful permissions like webRequest API allow monitoring and modifying every network request. This functionality was essential for adblockers to block ads and trackers efficiently.

In Manifest V3, background scripts are replaced by so-called service workers, which function off the main thread and have more restricted capabilities. They’re event-driven and have a limited lifetime. Service workers do not run continuously, can be terminated, and, therefore, work best when loaded for the first time or responding to the events.

Ad blocking is an important cybersecurity feature that protects users from malicious ads and tracking. The Cybersecurity and Infrastructure Security Agency (CISA) recommends blocking ads.

Many developers still need to update

As of May 14th, at least eleven of the 25 most popular Chrome extensions were still using the older Manifest V2 system.

That includes Google Translate, Zoom, Office, Microsoft Bing Search for Chrome, MetaMask Ethereum Wallet, Kaspersky Protection, and my favorite adblocker, uBlock Origin, which has been downloaded by 37 million users.

Other extensions were: Netflix Party, Screencastify, Adguard AdBlocker, and IDM Integration Module.

I also checked the ten best Chrome extensions in 2024 as offered by Android Authority, and three of them, Bitwarden, Ghostery, and Dark Reader, were also using the older system.

As stated by Google, starting in June, Chrome will gradually no longer support the MV2 extensions, and user-visible warnings will be the first steps.

The move to MV3 was paused previously to address developer feedback and develop some solutions. However, now Google recommends that developers complete migration before June 2024, when MV2 extensions will lose their Featured badges. Google Chrome Web store has not accepted any new MV2 extensions since 2022.

According to chrome-stats.com, almost 110,000 developers have published a total of 126,416 Chrome extensions on the Chrome Web Store. More than half of them (53.6%) have not been updated in the past two years.

Most, or 83.23%, of all Chrome extensions have fewer than 1000 active users, and many have never been rated.

Google rigorously reviews extensions before publishing them on the Chrome Web Store. However, users should also be aware that an underground market exists where extensions change ownership, introducing potential updates and risks.

Cybernews has previously reported that useful adblockers, price trackers, or spell checker extensions might be significantly risking online safety. Oren Koren, co-founder of the cybersecurity firm Veriti, advised users to delete all Chrome extensions, and he wasn’t the only one. While Manifest V3 improves safety, extensions remain largely unsafe.