Websites Can Detect What Chrome Extensions You've Installed

Posted by timothy on Friday March 16, 2012 @07:50PM from the incognito-no-more dept.

dsinc writes "A Polish security researcher, Krzysztof Kotowicz, makes an worrisome entry in his blog: with a few lines of Javascript, any web site could list the extensions installed in Chrome (and the other browsers of the Chromium family). Proof of concept is provided here. As there are addons which deal with very personal things like pregnancy or religion, the easiness of access to those very private elements of your life is really troubling." Note: the proof of concept works, so don't click that link if the concept bothers you.

1 of 131 comments (clear)

Min score:

Reason:

Sort:

Re:Only a partial list by Anonymous Coward · 2012-03-16 20:50 · Score: 5, Insightful

The detector works by injecting SCRIPT elements referring to chrome-extension://[id]/manifest.json. It checks if this works for several popular extension ids. Common sense would dictate that it should be impossible to load chrome-extension: resources from http: contexts but I checked in a recent Chromium build and the browser just loads the resource. Chromium must be programmed by interns.