Building a spy Chrome extension under Manifest v3

Matt Frisbie takes a look at the current limitations of Manifest v3 by building a Chrome extension that steals as much data as it can. The PoC simply requests all possible permissions, and upon installation Chrome displays a warning message in a scrolling box that shows only five of the warnings above the fold. From there, cookies, the entire browsing history, silent screenshots, request bodies and every keystroke are a few API calls away. That fits the EFF’s argument that Manifest v3 restricts capabilities for all extensions without doing much against malicious ones, which mostly just observe the conversation between your browser and the websites you visit. He even provides the Spy Extension code on GitHub. Pro tip: scroll down before clicking “Add extension”.