Google Chromium team announced of making changes that will make the security of Chrome's extension system even better. "Since we launched the extension system, the state of the art in web security has advanced with technologies like Content-Security-Policy (CSP). Extension developers have been able to opt into these features, and now we're enabling these security features by default," blogged Adam Barth, Chrome Security Engineer.
A recent UC Berkeley study suggested that these restrictions, taken together, would substantially improve the security of the extension system: "These defenses are extremely effective: adopting one of the recommended CSPs would prevent 96% (49 out of 51) of the core extension vulnerabilities we found."
Barth notes, "Users can continue to install extensions that're available in the store regardless of whether they're secured with CSP or not. This means they will not lose any of the functionality they've added to Chrome."
"Developers will be able to choose when to enable the new behavior. To ease the transition, we've introduced a new manifest version attribute in the extension manifest in Chrome 18 (currently in beta)," added Barth.
"For most extensions, updating them to manifest_version 2 will require the developer to move inline scripts out-of-line and to move scripts loaded from the network into the extension package. Developers are not required to update their extensions to manifest_version 2 immediately, but, over time, more of the extension ecosystem will encourage developers to update their extensions," he said.
When a developer updates his or her extension to use manifest_version 2, Chrome will enforce the following CSP policy by default:
script-src 'self'; object-src 'self'
- Extensions can no longer use inline scripts, such as
<script> ... </script>. Instead, extensions must use out-of-line scripts loaded from within their package, such as
- Extensions can no longer use
eval(). Note: If you're using eval to parse JSON today, we suggest using
- Extensions can load plug-ins, such as SWF files, only from within their package or from a whitelist of HTTPS hosts.