tldr.ar

13 readers
0 users here now

TL;DR version:

We're still figuring out what our policies are regarding federation and moderation but illegal nasty shit is not allowed and it will never be and illegal non-nasty shit (I.E. software piracy, whistling a copyrighted song, etc ) is only allowed in external communities (for now).

founded 11 months ago
ADMINS
tldradmin
sirpan
mrtomich
listing: all - local
search
1
69
Password-stealing Chrome extension smuggled on to Web Store (www.malwarebytes.com)
 
 

cross-posted from [email protected]

Original source: https://arxiv.org/pdf/2308.16321.pdf

  • Researchers at the University of Wisconsin–Madison found that Chrome browser extensions can still steal passwords, despite compliance with Chrome's latest security standard, Manifest V3.
  • A proof of concept extension successfully passed the Chrome Web Store review process, demonstrating the vulnerability.
  • The core issue lies in the extensions' full access to the Document Object Model (DOM) of web pages, allowing them to interact with text input fields like passwords.
  • Analysis of existing extensions showed that 12.5% had the permissions to exploit this vulnerability, identifying 190 extensions that directly access password fields.
  • Researchers propose two fixes: a JavaScript library for websites to block unwanted access to password fields, and a browser-level alert system for password field interactions.
2
149
Password-stealing Chrome extension smuggled on to Web Store (www.malwarebytes.com)
 
 

cross-posted from [email protected]

Original source: https://arxiv.org/pdf/2308.16321.pdf

  • Researchers at the University of Wisconsin–Madison found that Chrome browser extensions can still steal passwords, despite compliance with Chrome's latest security standard, Manifest V3.
  • A proof of concept extension successfully passed the Chrome Web Store review process, demonstrating the vulnerability.
  • The core issue lies in the extensions' full access to the Document Object Model (DOM) of web pages, allowing them to interact with text input fields like passwords.
  • Analysis of existing extensions showed that 12.5% had the permissions to exploit this vulnerability, identifying 190 extensions that directly access password fields.
  • Researchers propose two fixes: a JavaScript library for websites to block unwanted access to password fields, and a browser-level alert system for password field interactions.
view more: next ›