Browser Security and Exploitation

  1. Browser Extensions and Plugin Security
    1. Extension Architecture
      1. Manifest File Structure
        1. Permission Declarations
          1. Content Script Configuration
            1. Background Script Setup
            2. Extension Components
              1. Background Scripts
                1. Content Scripts
                  1. Options Pages
                  2. Extension APIs
                    1. Browser API Access
                      1. Cross-Origin Permissions
                        1. Native Messaging
                      2. Extension Security Model
                        1. Permission System
                          1. Host Permissions
                            1. API Permissions
                              1. Optional Permissions
                              2. Content Script Isolation
                                1. Isolated World Concept
                                  1. DOM Access Restrictions
                                    1. JavaScript Context Separation
                                    2. Cross-Origin Communication
                                      1. Message Passing Security
                                        1. Origin Validation
                                          1. Privilege Escalation Prevention
                                        2. Extension Vulnerabilities
                                          1. Privilege Escalation
                                            1. Over-Privileged Extensions
                                              1. Permission Abuse
                                                1. API Misuse
                                                2. Cross-Site Scripting in Extensions
                                                  1. Content Script Injection
                                                    1. Popup Page XSS
                                                      1. Options Page Vulnerabilities
                                                      2. Insecure Communication
                                                        1. Message Passing Vulnerabilities
                                                          1. Native Messaging Security
                                                            1. External Communication Risks

                                                        Previous

                                                        11. Vulnerability Research Methods

                                                        Go to top

                                                        Next

                                                        13. Emerging Attack Surfaces