Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

Breaking Microsoft Edge Extensions Security Policies

media.ccc.de via YouTube

Overview

Save Big on Coursera Plus. 7,000+ courses at $160 off. Limited Time Only!
Explore the critical security vulnerabilities in Microsoft Edge browser extensions in this 30-minute conference talk from the 36C3 event. Dive into the intricacies of browser extension permissions, focusing on host access permissions and their potential for exploitation. Learn how researchers discovered methods to bypass these permissions, allowing malicious extensions to access sensitive data across various websites and even local system files. Understand the implications of this security flaw, which led to the assignment of CVE-2019-0678. Follow the speaker's journey through extension implementation, manipulation of Tabs API, exploitation of JavaScript protocol, and escalation of Content Security Policy privileges. Gain insights into how these vulnerabilities could lead to unauthorized access to emails, local files, and internal browser settings. Discover the potential risks associated with browser extensions and the importance of robust security measures in protecting user privacy and data.

Syllabus

Intro
Browser Extensions
Permission Model In Extensions
Host Access Permissions
Sample Extension
Load Local Files & Privileged Pages
JavaScript Protocol
Host Permission Bypass
Stealing Google Emails
Stealing Local Files
Changing internal dev settings
Enabling/Disabling Adobe F Player
Edge Reading Mode
Other Extensions Internal Pages
CSP Privileges Escalation

Taught by

media.ccc.de

Reviews

Start your review of Breaking Microsoft Edge Extensions Security Policies

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.