An Empirical Study of JavaScript Inclusion Security Issues in Chrome Extensions
Chong Guan
TL;DR
The paper addresses the security of JavaScript inclusions in Chrome extensions, an area less explored than web pages, by employing a hybrid static/dynamic analysis to systematically enumerate inclusions across a large extension corpus. It demonstrates that while most inclusions are local, a non-trivial set of remote inclusions pose arbitrary-code-execution risks, and that a substantial fraction of extensions rely on outdated or vulnerable libraries, notably jQuery. Key contributions include a measurement framework, a vulnerability taxonomy for remote inclusions, and library usage insights with concrete prevalence figures (e.g., 21.88% of extensions loading vulnerable libraries). The findings have practical implications for extension security auditing, developer guidance, and platform-level mitigations, and point to future work extending the approach to other browsers and addressing detection gaps in dynamic ContentScripts.
Abstract
JavaScript, a scripting language employed to augment the capabilities of web browsers within web pages or browser extensions, utilizes code segments termed JavaScript inclusions. While the security aspects of JavaScript inclusions in web pages have undergone substantial scrutiny, a thorough investigation into the security of such inclusions within browser extensions remains absent, despite the divergent security paradigms governing these environments. This study presents a systematic measurement of JavaScript inclusions in Chrome extensions, employing a hybrid methodology encompassing static and dynamic analysis to identify these inclusions. The analysis of 36,324 extensions revealed 350,784 JavaScript inclusions. Subsequent security assessment indicated that, although the majority of these inclusions originate from local files within the extensions rather than external servers, 22 instances of vulnerable remote JavaScript inclusions were identified. These remote inclusions present potential avenues for malicious actors to execute arbitrary code within the extension's execution context. Furthermore, an analysis of JavaScript library utilization within Chrome extensions disclosed the prevalent use of susceptible and outdated libraries, notably within numerous widely adopted extensions.