Synacktiv researchers discovered a technique to silently inject malicious Chrome extensions by manipulating preference files and cryptographic signatures on Windows domain systems.
By calculating correct MACs for extension entries, attackers can force-load arbitrary extensions without user interaction, enabling credential theft, traffic interception, and screen capture.
The MAC trick builds on a 2020 paper by Picazo-Sanchez, Schneider and Sabelfeld that found the HMAC seed hard-coded in resources.pak instead of randomly generated, and Google answered back then that defeating the HMAC signals a violation of its Unwanted Software Policy.
Synacktiv also released extloader, which deploys such an extension into a remote user’s browser profile using a password or an NTLM hash.
Chrome’s extension security model just got a reality check.
