Isolating malicious content scripts of browser extensions. (2017)

• Record Type: Journal Article
• Authors: Patil, Kailas
• Is Part Of: International journal of information privacy, security and integrity. Volume 3:Number 1(2017)
• Page Start: 18
• Page End: 37
• Publication Date: 2017
• Subjects: browser extensions -- malicious content scripts -- web application integrity -- shadow DOM -- injection attacks -- information privacy -- security -- integrity; Computer security -- Periodicals; Computer networks -- Access control -- Periodicals; Information technology -- Security measures -- Periodicals; Data protection -- Periodicals; Privacy, Right of -- Periodicals; 005.805
• Languages: English
• ISSNs: 1741-8496

Abstract

In recent years, browser extensions gain great popularity among users, as they significantly enhance functionality and improve the usability of web browsers. Browser extensions can have high privileges to access web page content, thus recent browsers, such as Chrome, controls their capabilities with permissions. However, permission control is not effective to control the behaviours of content scripts injected into web sessions. Once injected into victim web sessions, malicious content scripts can perform all sorts of actions in a web application without user's knowledge. Therefore, content scripts pose serious threats to the confidentiality and integrity of web application data. To address this problem, we propose a mechanism, SessionGuard, which isolates content scripts in an isolated environment, called the shadow DOM. With the shadow DOM, SessionGuard provides content scripts an encrypted view of web application data, and controls their access to the original DOM. We have developed a proof-of-concept prototype in the Google Chrome web browser with little effect on normal browsing experience. Our experiments with real-world browser extensions demonstrate the effectiveness of the SessionGuard in protecting the confidentiality and integrity of web application data against malicious content scripts.