Extending Password (in)Security to the Browser

The talk opens by framing the problem: organizations now authenticate users across many outside applications, and the session cookie that follows a login sits in the browser, where anything running there, including extensions, can read it. Extensions run whenever the browser is open, stay largely invisible to endpoint tools, and are tracked only by their ID, so an extension approved once can later be swapped for malicious code and keep its approval.

Eshed walks through the extension permissions that matter for credential theft, including cookie access, scripting and page content visibility, and argues that many store extensions request far more than they need. He describes how attackers obtain extensions through compromised developer accounts, purchase, or building their own, and presents a case where a cookie-stealing extension aimed at Microsoft Entra stopped working until the login added a factor kept in the browser cache, which the extension could also read.

On defense, the options reviewed were allow lists, block lists, banning extensions outright, and risk-based management that inventories extensions and versions across browsers and enforces policy through device management. Eshed points out the practical gaps: browsers differ in enterprise visibility, extensions change constantly, and enforcement is hard to automate. He closes by arguing that attackers will keep shifting toward the browser as other routes become harder.