Protecting Windows users from malicious extensions
Read in the Chromium Blog:
Extensions are a great way to enhance the browsing experience; whether users want to quickly post to social networks or to stay up to date with their favorite sports teams. Many services bundle useful companion extensions, which causes Chrome to ask whether you want to install them (or not). However, bad actors have abused this mechanism, bypassing the prompt to silently install malicious extensions that override browser settings and alter the user experience in undesired ways, such as replacing the New Tab Page without approval. In fact, this is a leading cause of complaints from our Windows users.
Since these malicious extensions are not hosted on the Chrome Web Store, it’s difficult to limit the damage they can cause to our users. As part of our continuing security efforts, we’re announcing a stronger measure to protect Windows users: starting in January on the Windows stable and beta channels, we’ll require all extensions to be hosted in the Chrome Web Store. We’ll continue to support local extension installs during development as well as installs via Enterprise policy, and Chrome Apps will also continue to be supported normally.
If your extensions are currently hosted outside the Chrome Web Store you should migrate them as soon as possible. There will be no impact to your users, who will still be able to use your extension as if nothing changed. You could keep the extensions hidden from the Web Store listings if you like. And if you have a dedicated installation flow from your own website, you can make use of the existing inline installs feature.
Protecting our users is a key priority, and we believe this change will help those whose browser has been compromised by unwanted extensions. If you have questions, please get in touch with us on the Chromium extensions group.
Erik Kay, Engineering Director
Comments
-
Hi @borekon,
Thanks for sharing that article!
I just want to clarify, that Chromium is not code signed, and since 1Password must validate a browser with code signing before it will fill or anything, we currently will not work with Chromium, even if the extension is installed. You can access the 1Password extensions for Google Chrome via the Chrome Web Store:
0
