Browser Extensions

Security researchers from USENIX, the Advanced Computing Systems Association, discovered two vulnerabilities that affect the extension systems available within popular web browsers, such as Firefox, Safari, Chrome, Opera, and others. Successful exploitation of these vulnerabilities could allow a threat actor to expose a list of the user's installed extensions. This information can be used to identify users based on their installed extensions, to reveal anonymous users using a VPN or Tor to encrypt network traffic, or to create advertising profiles. Additionally, a malicious actor can use the information to identify and exploit extensions with known or zero-day vulnerabilities. The two vulnerabilities have been disclosed to browser developers prior to being made public, but they have yet to be patched. The NJCCIC recommends all users and administrators review theresearch paper and audit your browsers to determine what extensions are on your systems, and purge those that are not necessary or may have been acquired from untrusted sources. The downloading of extensions should be kept to a minimum and only done so after researching the developer and the data collected by the extension.