auditing-browser-extension-trust

name	auditing-browser-extension-trust
description	Audit a browser extension (Manifest V3) for a trust boundary another web page or extension can cross to reach a privileged capability, after the permission scope and the message-sender checks are resolved. Covers an externally_connectable or onMessageExternal handler that verifies an origin but not the calling script, a content-script-to-background message handler with no sender validation, host permissions broader than the extension needs, a web_accessible_resources page that acts on URL parameters, an injected content script writing page-controlled data to a DOM sink, and a weak or eval-permitting content-security policy. Use when reviewing the manifest, background and content scripts, and cross-context message passing, not the web-page DOM sink taxonomy the client-side DOM skill owns. An untrusted web origin or another extension is the source, a privileged extension API or DOM sink is the sink, and a message reaching it without a sender-and-origin check is the bug.
license	MIT

Auditing browser extension trust: what another page can reach through the extension

A browser extension is dangerous where a web page it does not trust, or another installed extension, can drive one of its privileged capabilities: a host-scoped fetch that carries the user's cookies, a chrome-namespace API, or a DOM write in a content script that runs with the extension's reach. The bug is almost always a message boundary that verifies too little: an external handler that checks the calling domain but not that a trusted script is calling, or a content-script-to-background channel that trusts any sender. You audit it by resolving, per privileged sink, whether every path that reaches it validates the sender identity and origin and whether the permission it uses is scoped to what the extension needs. Stay on the extension's trust boundary; the web-page DOM sink taxonomy belongs to the client-side DOM skill.