How to Do Chrome Extension Code Reviews

Learn effective techniques for conducting Chrome extension code reviews in this 18-minute conference talk. Explore the security implications of Chrome extensions' broad access to user data, including cookies, tokens, and browsing history. Discover tools and methods for identifying potential vulnerabilities, starting with the manifest.json file and its permissions. Examine three common insecure coding practices in extensions and their associated security risks. Gain insights into Chrome API scopes, particularly chrome.webRequest and chrome.cookies, and understand their significance for bug bounty hunters. Presented by Breanne Boland, an application security engineer at Salesforce, this talk provides valuable knowledge for both security professionals and developers working with Chrome extensions.