Browser extensions are software supply chain components that most security teams ignore. They run in the browser with permissions that can include reading every page a user visits, modifying page content, accessing cookies, and making network requests to any domain. They auto-update silently. And unlike npm packages or Python libraries, they execute in the context of a user's active browser session, with access to credentials, session tokens, and sensitive data displayed on screen.
The extension permission model is the mechanism that governs what extensions can do. Understanding this model is essential for assessing the supply chain risk that extensions introduce to your organization.
How Extension Permissions Work
Chrome (Manifest V3)
Chrome extensions declare permissions in a manifest.json file. Permissions fall into several categories:
Host permissions define which websites the extension can access. An extension with "host_permissions": ["<all_urls>"] can read and modify every page the user visits. An extension with "host_permissions": ["*://*.example.com/*"] is limited to example.com.
API permissions define which browser APIs the extension can use. Examples include storage (local data storage), tabs (access to open tabs), cookies (read and modify cookies), webRequest (intercept network requests), and history (read browsing history).
Content scripts are JavaScript files injected into web pages. They can read and modify the DOM of pages matching specified URL patterns. A content script injected into a banking website can read account balances, form inputs, and session tokens.
Background service workers run persistently and can make network requests, access storage, and coordinate between content scripts. They are the extension's brain and have access to all granted permissions.
Firefox
Firefox uses a similar model but with some differences in enforcement. Firefox extensions can request permissions at install time or at runtime. The <all_urls> permission grants the same broad access as in Chrome.
The Permission Escalation Problem
The critical issue is that permissions are granted to the extension identity, not to a specific version. When an extension updates, the new version inherits all permissions granted to the previous version. If the extension does not request new permissions, the update is applied silently without user interaction.
This means that an extension developer (or an attacker who compromises the developer's account) can push an update that uses existing permissions maliciously without triggering any user-facing notification.
Supply Chain Attack Vectors
Developer Account Compromise
The most direct attack is compromising the developer account on the Chrome Web Store or Firefox Add-ons. The attacker pushes a malicious update that inherits the extension's existing permissions and its existing user base. This has happened repeatedly:
- In 2017, the Web Developer extension (1 million users) was compromised and updated to inject ads
- In 2018, the MEGA extension was compromised to steal credentials
- In 2022, dozens of extensions were compromised in a coordinated phishing campaign targeting developers
Extension Acquisition
An attacker purchases or acquires a legitimate extension from its developer. The extension already has permissions and users. The new owner pushes an update that adds malicious functionality within the scope of existing permissions.
This is particularly insidious because it does not involve any technical compromise. The transaction is legal. The extension store has no mechanism to warn users that an extension has changed ownership.
Dependency Compromise
Extensions, like other software, use third-party libraries. An extension that bundles a compromised JavaScript library inherits whatever malicious code is in that library. Because extensions run with elevated permissions, a supply chain attack through an extension's dependency is more dangerous than the same attack through a web application.
Permission Over-Requesting
Many extensions request far more permissions than they need. A spell-checker that requests <all_urls> and tabs permissions has access to every page and every tab, even though it only needs access to text fields. If this extension is compromised, the attacker gets the full scope of these unnecessary permissions.
Enterprise Risk Assessment
For enterprise environments, browser extensions represent a supply chain risk that compounds with scale. Consider:
- If 1,000 employees each have 10 browser extensions, that is 10,000 third-party software components running with access to corporate web applications
- Each extension auto-updates independently, potentially introducing new code without review
- Extensions with host permissions can read data from internal web applications, SaaS platforms, and cloud consoles
- Extensions can exfiltrate data by making network requests to external domains
The specific risks include:
Credential theft. Extensions with content script access can read login forms, session cookies, and OAuth tokens from corporate web applications.
Data exfiltration. Extensions can read page content from internal applications (HR systems, financial platforms, code review tools) and send it to external servers.
Session hijacking. Extensions with cookie access can steal session tokens from any site in their permission scope.
Phishing facilitation. Extensions can modify page content, potentially injecting phishing elements into legitimate corporate applications.
Mitigation Strategies
Extension Allowlisting
Chrome Enterprise and Firefox for Enterprise support extension allowlisting via group policy. Organizations can:
- Block all extensions by default
- Allowlist specific approved extensions by ID
- Force-install required extensions
- Block extensions that request specific permissions
This is the most effective mitigation but requires ongoing management. Someone must evaluate extension requests, assess their permissions, and maintain the allowlist.
Permission-Based Policies
Rather than evaluating individual extensions, some organizations create policies based on permissions:
- Block any extension requesting
<all_urls> - Block any extension requesting
cookiesorwebRequest - Allow extensions that only request limited permissions like
storageand specific host patterns
This approach is more scalable but may block legitimate extensions that need broad permissions (password managers, accessibility tools).
Extension Monitoring
Monitor which extensions are installed across your endpoint fleet. Tools like CrowdStrike, Carbon Black, and Jamf can report installed extensions. Flag:
- New extensions that appear across multiple endpoints simultaneously
- Extensions that were recently updated (especially if permissions changed)
- Extensions that are no longer available on the store (possibly removed for policy violations)
- Extensions requesting sensitive permissions
Network Monitoring
Extensions that exfiltrate data must make network requests. Monitor for:
- Outbound requests from browser processes to unusual domains
- Large data transfers from browser processes that do not correspond to visible user activity
- Connections to known malicious infrastructure from browser processes
Developer Responsibility
If your organization develops browser extensions, treat them as first-class software supply chain components:
- Minimize permissions to only what the extension needs
- Secure developer accounts with hardware security keys
- Review and audit all third-party libraries included in the extension
- Implement content security policies within the extension
- Use the Chrome Web Store's two-factor authentication requirement
How Safeguard.sh Helps
Safeguard.sh helps organizations manage the software components within browser extensions by scanning their dependency trees for known vulnerabilities. For organizations that develop extensions, Safeguard tracks the third-party libraries bundled into extensions, generates SBOMs for extension packages, and monitors for vulnerabilities in extension dependencies. Policy gates can enforce security standards on extension builds before they are published, reducing the risk that vulnerable dependencies make it into production extensions.