CoCo: Efficient Browser Extension Vulnerability Detection via Coverage-guided, Concurrent Abstract Interpretation
Extensions complement web browsers with additional functionalities and also bring new
vulnerability venues, allowing privilege escalations from adversarial web pages to use …
vulnerability venues, allowing privilege escalations from adversarial web pages to use …
Doublex: Statically detecting vulnerable data flows in browser extensions at scale
Browser extensions are popular to enhance users' browsing experience. By design, they
have access to security-and privacy-critical APIs to perform tasks that web applications …
have access to security-and privacy-critical APIs to perform tasks that web applications …
Mystique: Uncovering information leakage from browser extensions
Browser extensions are small JavaScript, CSS and HTML programs that run inside the
browser with special privileges. These programs, often written by third parties, operate on …
browser with special privileges. These programs, often written by third parties, operate on …
What is in the Chrome Web Store?
This paper is the first attempt at providing a holistic view of the Chrome Web Store (CWS).
We leverage historical data provided by ChromeStats to study global trends in the CWS and …
We leverage historical data provided by ChromeStats to study global trends in the CWS and …
Botnet in the browser: Understanding threats caused by malicious browser extensions
R Perrotta, F Hao - IEEE security & Privacy, 2018 - ieeexplore.ieee.org
Browser extension systems risk exposing APIs, which are too permissive and cohesive with
the browser's internal structure, leaving a hole for malicious developers to exploit security …
the browser's internal structure, leaving a hole for malicious developers to exploit security …
Effective detection of vulnerable and malicious browser extensions
Unsafely coded browser extensions can compromise the security of a browser, making them
attractive targets for attackers as a primary vehicle for conducting cyber-attacks. Among …
attractive targets for attackers as a primary vehicle for conducting cyber-attacks. Among …
Detecting dom-sourced cross-site scripting in browser extensions
J Pan, X Mao - 2017 IEEE International Conference on …, 2017 - ieeexplore.ieee.org
In recent years, with the advances in JavaScript engines and the adoption of HTML5 APIs,
web applications begin to show a tendency to shift their functionality from the server side …
web applications begin to show a tendency to shift their functionality from the server side …
Malicious browser extensions at scale: Bridging the observability gap between web site and browser
Browser extensions enhance the user experience in a variety of ways. However, to support
these expanded services, extensions are provided with elevated privileges that have made …
these expanded services, extensions are provided with elevated privileges that have made …
Exposing and Addressing Security Vulnerabilities in Browser Text Input Fields
In this work, we perform a comprehensive analysis of the security of text input fields in web
browsers. We find that browsers' coarse-grained permission model violates two security …
browsers. We find that browsers' coarse-grained permission model violates two security …
Analyzing the dangers posed by Chrome extensions
A common characteristic of modern web browsers is that their functionality can be extended
via third-party add-ons. In this paper we focus on Chrome extensions, to which the Chrome …
via third-party add-ons. In this paper we focus on Chrome extensions, to which the Chrome …