After you, please: browser extensions order attacks and countermeasures

摘要: Browser extensions are small applications executed in the browser context that provide additional capabilities and enrich user experience while surfing web. The acceptance of current browsers is unquestionable. For instance, Chrome's official extension repository has more than 63,000 extensions, with some them having 10M users. When installed, pushed into an internal queue within browser. order which each executes depends on a number factors, including their relative installation times. In this paper, we demonstrate how can be exploited by unprivileged malicious (i.e., one no permissions those already assigned when accessing web content) to get access any private information other have previously introduced. We propose solution does not require modifying core engine, since it implemented as another extension. prove our approach effectively protects against usual attackers installed extension) well strong effects all knowing who did what). also soundness robustness under reasonable assumptions.