Sneaky Extensions: The MV3 Escape Artists

Browser Extensions in Modern Workspaces

Browser extensions have become essential workplace tools for video conferencing, collaboration, and productivity. However, extensions holding standard low-privilege permissions often expose end users to extensive privacy and security threats.

Security Boundaries in Manifest V3

Google introduced Manifest V3 (MV3) to restrict extension capabilities, notably banning dynamic script evaluation functions such as eval and new Function to prevent arbitrary code execution.

Bypassing Restrictions with Minimal Permissions

Researchers demonstrated attack techniques requiring only default permissions common to ninety-five percent of Chrome Web Store extensions. These methods execute arbitrary code and stealthily capture clipboard contents, webcam streams, and microphone feeds.

Cross Extension Credential Theft

Malicious extensions can abuse shared browser APIs to interfere with neighboring extensions, intercepting one-time passwords (OTPs), credit card details, and stored credentials from password managers.