Re: Chrome browser insecurity

Le 20/08/2013 16:02, Viswanathan, Kapaleeswaran (PPS Hub R&D) a écrit :
> Chrome extensions violate basic browser security assumptions. This was a remarkable revelation to me, which I least expected.
>
> The official claim, which I bought into, that Chrome browser is secure is at the following URL.
> http://www.google.com/googlebooks/chrome/med_02.html
>
> The following website helped me realize the revelation.
> http://developer.chrome.com/extensions/messaging.html#security-considerations
>
> Can there be a Trojan-free log-in page with an insecure Chrome extension?
A browser with a given extension or a set of extensions is nothing but a 
different browser.
So your question can be rephrased as:
Can there be a Trojan-free log-in page with an insecure browser?

And very much like some pages are crafted to abuse insecure web 
browsers, it's possible to craft pages to abuse web browsers with 
insecure extensions.

> I was also wondering what the security of CAJA may be when considering insecure Chrome extensions.
(disclaimer: I'm not part of the Caja team, but trying an answer anyway)
Chrome with an insecure extension is some form of a non-standard 
browser. Caja needs to make some assumptions about the environment it 
runs guest code in. Caja has made a fantastic job working around browser 
bugs that deviate from standards and don't hold Caja-relevant assumptions.
But Caja can't predict all broken assumptions by extensions.

For instance, it should be possible to write an extension that replaces 
the global 'Object' with a getter than only throws. Not sure what Caja 
could do here (if that's not enough, make accessing any standard 
property/function throw)

David