CRXaminer - Deep Dive Into Chrome Extensions (Plus Tool)

The talk opens with why Chrome extensions matter to security teams. Extensions can see and act on every site a user visits, so a single bad one can read cookies or rewrite pages. The speaker walks through real cases: a dark-mode add-on with broad access, a coupon extension that swapped affiliate codes, and a data-loss-prevention extension whose publisher was phished, letting attackers steal business account cookies. He also describes a popular extension bought and redirected without users being notified.

He then explains the file format, a CRX3 that is essentially a zip archive, and the manifest.json that declares granted permissions and target sites. He describes CRXaminer, a Ruby on Rails web app that downloads an extension by its ID, runs rule-based checks, and asks an LLM to adjust the rating using publisher context. Comparing before and after, most critical results moved to high, though severity labels remain hard to make meaningful.

A live demo follows, and the audience discusses cost, prompt design, and whether Chrome's permission model should be more granular. Similar risks were raised for VS Code and Docker Desktop extensions. The takeaway is to scrutinize requested permissions and consider isolating risky extensions in a separate browser profile.