Malicious Extensions Circumvent Google’s Remote Code Ban

Security researcher Wladimir Palant shows how malicious Chrome extensions are evading Google’s ban on remote code execution. Google’s definition of remotely hosted code covers anything the browser executes that does not come from the extension’s own files, but explicitly excludes data such as JSON or CSS. That leaves plenty of room: extensions download configurations that inject unescaped HTML into every page, push declarativeNetRequest rules that strip security headers, or ship a tiny interpreter for server-supplied instructions. Technically it’s all data, practically it’s remote code. Palant names several clusters of extensions doing exactly this, some of them with hundreds of thousands of users. A week earlier he had already called the Chrome Web Store a mess, with reports going nowhere and spam extensions carrying the “Featured” badge.