Privacy Leakage Attacks in Browsers by Colluding Extensions

摘要: Browser Extensions (BE) enhance the core functionality of and provide customization to it. extensions enjoy high privileges, sometimes with same privileges as itself. As a consequence, vulnerable or malicious extension might expose system resources attacks. This may put at risk unwanted operations, privilege escalation etc. BE can snoop on web applications, launch arbitrary processes, even access files from host file system. In addition that, an collude other installed share objects change preferences. Although well-intentioned, developers are often not security experts. Hence, they end up writing code. this paper we present new attacks via extensions. particular, attack allows two communicate collaborate each in such way achieve goal. We identify points development framework as: (a) object reference sharing, (b) preference overriding. illustrate effectiveness proposed using various scenarios. Furthermore, proof-of-concept illustration for domains including Banking & shopping. believe that scenarios use use-case demonstration underlines severity presented attack. Finally, also contribute initial address