Hulk: Eliciting Malicious Behavior in Browser Extensions

We present Hulk, a dynamic analysis system that de-tects malicious behavior in browser extensions by mon-itoring their execution and corresponding network activ-ity. Hulk elicits malicious behavior in extensions in two ways. First, Hulk leverages HoneyPages, which are dy-namic pages that adapt to an extension’s expectations in web page structure and content. Second, Hulk employs a fuzzer to drive the numerous event handlers that mod-ern extensions heavily rely upon. We analyzed 48K ex-tensions from the Chrome Web store, driving each with over 1M URLs. We identify a number of malicious ex-tensions, including one with 5.5 million affected users, stressing the risks that extensions pose for today’s web security ecosystem, and the need to further strengthen browser security to protect user data and privacy.