Extension Land: Exploits and Rootkits in Your Browser Extensions
Barak Sternberg exposes vulnerabilities in browser extensions, demonstrating how to weaponize privileged extension APIs into persistent browser rootkits.
Summary
The Unchecked Power of Browser Extensions
Browser extensions enjoy sweeping permissions across visited web pages, cookies, and local storage, often operating outside standard web sandbox boundaries.
Auditing Extension IPC and Message Passing
Barak Sternberg analyzes inter-process communication (IPC) and `window.postMessage` handlers in popular extensions, uncovering severe input validation oversights.
Transforming Extensions into Browser Rootkits
By compromising an extension via malicious web pages, an attacker gains persistent access to browser storage, bypasses Content Security Policies (CSP), and intercepts plaintext keystrokes.
Hardening Extension Manifests and Defenses
Sternberg presents defensive development patterns and security auditing tools for developers to restrict extension API exposure and prevent cross-origin injection.
Related talks
Live Presentations·37 min
Barak Sternberg
Barak Sternberg delivers the live demonstration on weaponizing browser extension IPC and message-passing flaws into persistent browser rootkits.
Main Stage·47 min
Jeff Dileo
Demonstrates how eBPF programs can be weaponized to create undetectable Linux kernel rootkits with full privilege and persistent covert channels.
Main Stage·50 min
Lior Shmueli · Tomer Peled
Exposes UI redressing and clickjacking vectors in popular browser extensions that trick users into granting administrative cloud permissions with a single click.