Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks

Browser extensions enable rich experience for the users of today\u27s web. Beingdeployed with elevated privileges, extensions are given the power to overruleweb pages. As a result, web pages often seek to detect the installed extensions,sometimes for benign adoption of their behavior but sometimes as part ofprivacy-violating user fingerprinting.Researchers have studied a class of attacks that allow detecting extensions byprobing for Web Accessible Resources (WARs) via URLs that include publicextension IDs.Realizing privacy risks associated with WARs, Firefox has recently moved torandomize a browser extension\u27s ID, prompting the Chrome team to plan forfollowing the same path.However, rather than mitigating the issue, the randomized IDs can in factexacerbate the extension detection problem, enabling attackers to use arandomized ID as a reliable fingerprint of a user.We study a class of extension revelation attacks, where extensions revealthemselves by injecting their code on web pages.We demonstrate how a combination of revelation and probing can uniquely identify90% out of all extensions injecting content, in spite of a randomization scheme.We perform a series of large-scale studies to estimate possible implications ofboth classes of attacks.As a countermeasure, we propose a browser-based mechanism that enables controlover which extensions are loaded on which web pages and present a proof ofconcept implementation which blocks both classes of attacks