<story><title>Malware in the browser: how you might get hacked by a Chrome extension</title><url>https://kjaer.io/extension-malware/</url></story><parent_chain></parent_chain><comment><author>Hamcha</author><text>If you like to tweak your Chrome install, check out:&lt;p&gt;chrome:&amp;#x2F;&amp;#x2F;flags&amp;#x2F;#extension-active-script-permission&lt;p&gt;It adds an extra level of permission where each extension that doesn&amp;#x27;t ask for a specific website is, by default, locked out of every website, and you have to enable it manually by either clicking on it, whitelisting the websites where it can run or globally (example pic, sorry for not being in english:  &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;puu.sh&amp;#x2F;q5QFR&amp;#x2F;d6004da3bb.png&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;puu.sh&amp;#x2F;q5QFR&amp;#x2F;d6004da3bb.png&lt;/a&gt;)</text></comment>
<story><title>Malware in the browser: how you might get hacked by a Chrome extension</title><url>https://kjaer.io/extension-malware/</url></story><parent_chain></parent_chain><comment><author>the_duke</author><text>The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK.&lt;p&gt;Extensions make it even easier to install them, though, just need to redirect a user.&lt;p&gt;I&amp;#x27;ve also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message &amp;quot;To close the page, just install the XX extension&amp;quot;.&lt;p&gt;The only remedy is good screening in the app stores. Actually, for apps&amp;#x2F;extensions installed from the official repository, I would be OK with remote removal. This would probably spark an outcry from certain parties, but as long as it does not extend to manually installed extensions it&amp;#x27;s acceptable to me.</text></comment>