T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- manifest.json:6
- Finding
- Excessive Cross-Site Permissions Enable Automation on Unrelated Websites<![CDATA[ ## Vulnerability Details **File Location**: `manifest.json:6-7`; `background/sw.js:3-17`, `background/sw.js:384-465` **Vulnerability Type**: Excessive browser privileges and missing origin enforcement **Risk Level**: Medium ### Vulnerable Code ```json "permissions": ["tabs", "scripting", "storage", "downloads", "sidePanel", "activeTab"], "host_permissions": ["<all_urls>", "https://api.openai.com/*"], ``` The service worker uses these permissions to inject the automation content script into a selected tab: ```js async function ensureContentScript(tabId) { const pingResult = await pingContentScript(tabId); if (pingResult.ok) { return { ok: true }; } try { await chrome.scripting.executeScript({ target: { tabId }, files: ["content/index.js"] }); } catch (error) { return { ok: false, error: "cs_inject_failed" }; } const pingAfter = await pingContentScript(tabId); if (!pingAfter.ok) { return { ok: false, error: "cs_unavailable" }; } return { ok: true }; } ``` Non-navigation tools are dispatched to the injected content script without validating that the target tab belongs to a supported Amazon origin: ```js const csReady = await ensureContentScript(tabId); if (!csReady.ok) { return { ok: false, tool: toolCall.tool, tabId, error: csReady.error || "cs_unavailable" }; } const resultMessage = await chrome.tabs.sendMessage(tabId, { type: "tool.call", callId: context.callId, toolCall }); ``` ### Technical Analysis The extension is presented as an Amazon-oriented shopping and after-sales agent, but its `host_permissions` grant access to all URLs. Combined with `tabs` and `scripting`, the service worker can inject `content/index.js` into unrelated supported web origins. The injected content script exposes operations that can: - Read page text and DOM content. - Extract attributes and structured data. - Fill input fields. - Click buttons and links. - Send form or messaging conten ...[truncated 2214 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `<all_urls>` with explicit supported Amazon host patterns, such as the exact marketplaces required by the product. 2. Move exceptional domain access to `optional_host_permissions` and request it only in response to an explicit user action. 3. Before every injection and tool execution: - Retrieve the target tab with `chrome.tabs.get()`. - Parse its URL. - Require HTTPS. - Compare the hostname against a strict allowlist. - Reject unsupported schemes, origins, and subdomain lookalikes. 4. Apply the same allowlist to `browser.navigate`; do not accept arbitrary URLs from an LLM-generated plan. 5. Bind each run to its initially approved origin and stop the run if the tab navigates to another origin. 6. Display the target hostname, action type, selector, and relevant content in the confirmation interface. 7. Require stronger confirmation for state-changing actions such as clicking submit controls or automatically sending messages. 8. Remove unused permissions, particularly `downloads`, unless a documented feature requires them. 9. Consider statically registering content scripts only on supported Amazon origins instead of dynamically injecting them into arbitrary active tabs. ]]>