DoubleX: Statically Detecting Vulnerable Data Flows in Browser ...
summary
Built a static analyzer called DoubleX that finds external attacker-to-API flows in Chrome extensions and runs in seconds per extension. Analysis of 155k extensions yields 309 suspicious flows, with manual validation giving 89% precision 93% recall and allowing practical exploits against 184 extensions exploited (impacting ~2.4–2.9M users). Examples include universal XSS via tabs.executeScript, cross‑origin request abuse, and downloads triggered by missing sender restrictions; tool is publicly released.
AI-written summary · about
chapters (11)
- 0:00Browser extension security
- 1:25Vulnerable extensions danger
- 4:15Threat model for exploitation
- 9:08Attack scenarios with extensions
- 14:20DoubleX detection method
- 23:15DoubleX evaluation on Chrome
- 25:44Case studies of vulnerabilities
- 31:25Extension life cycle in store
- 33:10DoubleX performance
- 34:55Mitigation strategies
- 36:40Key takeaways
related talks
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
57mAutomated Detection of Firefox Extension-Reuse Vulnerabilities
45mThe evil friend in your browser
25mExtension Breakdown...
40mClient-Side Protection Against DOM-Base...
42mPrivacy Toolkit: Privacy Awareness In The Digital Age
31m360° View of XSS