Automated Detection of Firefox Extension-Reuse Vulnerabilities
summary
Legacy Firefox extensions share a global JavaScript namespace and no sandboxing, enabling adversaries to stitch together capabilities from multiple benign add-ons to perform network, file I/O and keystroke exfiltration without sensitive API calls in the malicious extension itself. A lightweight tool, CROSSFIRE static analyzer, parses ASTs, taints data and auto-generates exploits; testing across 2,000 Firefox extensions uncovers 255 working exploits (≈20% fully automated) and a submitted proof-of-concept extension passes review.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 1:42Agenda
- 2:35Extensions
- 4:41Extension Architecture
- 7:00Threat Model
- 10:58Existing Methods
- 13:31Jetpack
- 16:07Attack Model
- 17:59Impact
- 19:00Simple Attack
- 22:33Challenges
- 23:20Crossfire
- 24:53Demo
- 26:12AST Representation
- 27:04Global Functions
- 29:57analyzer
- 30:48functions
- 31:13extension folder
- 32:34secretpets
- 34:10example
- 36:20evaluation
- 38:33working exploits
- 39:00positive exploits
- 39:41performance
- 44:17limitations
- 46:27Secure Functional Data Sharing
- 47:33Static Analysis
- 48:35Conclusions
related talks
25mExtension Breakdown...
38mDoubleX: Statically Detecting Vulnerable Data Flows in Browser ...
45mThe evil friend in your browser
44mDefeating Firefox
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
33mBrowser Extensions
29mStandard Classification: Everything You Always Wanted to Know About Finge...
42mPrivacy Toolkit: Privacy Awareness In The Digital Age