Follow

Oh god...

All Chrome extensions can execute remote code in their own context:
bugs.chromium.org/p/chromium/i

Included in the bug report is a proof-of-concept web extension by gorhill, author of uBlock Origin.

> Such ability to execute remote code from extension's own context is how Hover Zoom and SpeakIt! were found to track and data mine users, see:

arstechnica.com/information-te

Show thread

Great... looks like the Chrome team is denying public access to this... and it wasn't captured beforehand in the wayback machine..

Show thread

Gorhill's proof-of-concept extension code is still up: gist.github.com/gorhill/b0316e. His tweets about it though have been deleted.

Show thread

And now the Gist has been removed. But it’s available on Archive.is: archive.is/hi5o1

Show thread

@andreas The issue author verified that Firefox is not affected by the vulnerability. One more reason to switch.

Sign in to participate in the conversation
nitro-fucking-horse

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!