Chrome Extension Risks and You
summary
Lyft inventories ~8,000 Chrome extension IDs from a quick sample, scores them with CRXcavator, imports results into a cartography module, and builds an automated review workflow that auto-declines disallowed installs. Managed Chrome devices and policy categories (approve/block, disallowed domains or permissions) cut unique user extensions by about 95% across a thousand-plus employees, with minimal ongoing ops time after initial rollout.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:10The problem
- 1:46Popular risky extensions
- 4:12Malicious extensions
- 6:30Chrome Web Store
- 8:37Other Extensions
- 9:53Privacy Policy
- 11:11The Plan
- 13:01The Workflow
- 16:29Automated Review Process
- 17:07User Experience
- 18:34Approaches
- 20:08Summary
related talks
45mThe evil friend in your browser
29mUnraveling the Threat of Chrome Based Malware
33mBrowser Extensions
31mShadow IT Battlefield: The CyberHaven Breach and...
45mWhat’s new in Chrome?
38mDoubleX: Statically Detecting Vulnerable Data Flows in Browser ...
29mHunting Malicious IDE Extensions: Building Detection at Scale... (Vinod Tiwari)
31mBuilding your first malicious chrome extension 😈