Later archive addition

An Evaluation of the Google Chrome Extension Security Architecture

Nicholas Carlini, Adrienne Porter Felt and David Wagner · USENIX

Examines how insecure network dependencies, website metadata and unsafe messaging bypass Chrome extension isolation boundaries. A review of 100 extensions separates observed vulnerabilities from hypothetical escalation paths and measures what privilege separation and permissions contain. Browser-provided metadata remains untrusted even outside content scripts.

Record

Researcher

Nicholas Carlini, Adrienne Porter Felt and David Wagner

Published by

USENIX

Format

Whitepaper

In the archive

• Added to the 2012 archive after the original list was published

Related sources

• Conference slides

Tags

• browser-extension
• xss
• case-study
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Nicholas Carlini, Adrienne Porter Felt and David Wagner, first published at the original source. Preserved copies are kept so the citation survives its host.