The attack method involves using the chrome.management API or web resource hitting to identify installed extensions, such as 1Password, and then temporarily disabling them to impersonate them. Once the user unknowingly enters their credentials into the fake extension, the information is sent to the attacker, who can then access all stored passwords and sensitive data. This vulnerability cannot be patched by updating the browser, as it exploits legitimate Chrome functionality, highlighting the need for a significant overhaul to prevent such attacks.
Key takeaways:
- A new vulnerability in Google Chrome and other Chromium browsers allows malicious extensions to impersonate any installed extension, putting sensitive data at risk.
- The attack involves tricking users into installing a benign-looking extension that later mimics sensitive apps like password managers and crypto wallets.
- The malicious extension uses techniques like web resource hitting to detect and impersonate target extensions, stealing credentials and sensitive information.
- The attack exploits legitimate Chrome functionality, making it difficult to patch, and highlights the risk of relying on visual cues for security confirmation.