Building your first malicious chrome extension 😈
summary
Builds a simple Chrome extension that converts currencies, then demonstrates concrete malicious modifications that work: adds affiliate tags to requests to monetize redirects, logs keystrokes to Firebase to harvest credentials, and captures tab screenshots and uploads them for data exfiltration. Shows code for manifest v2 and v3 on GitHub, explains bypass patterns used in the wild (remote code, eval/dynamic loading, obfuscation, auto‑updates) and cites Chrome review metrics (96.5% automated catch in 2015, reported 70% reduction after improvements). Also covers manifest v3, service workers, narrower permissions and enforced 2FA.
AI-written summary · about
chapters (7)
- 0:00The power of extensions
- 4:00Building a shopping tool
- 6:21Extension architecture
- 11:13Malicious capabilities
- 17:50Security and protections
- 22:19The shift to manifest v3
- 24:10Best practices and closing
related talks
36mBuilding your first malicious chrome extension 😈
29mUnraveling the Threat of Chrome Based Malware
45mThe evil friend in your browser
33mBecome a wizard and make the browser your own
44mWhen you can't afford 0days: Client-side exploitation for the masses
54mCrafting the next-generation Man-in-the-Browser Trojan
29mEverything You Ever Wanted To Know About Cross-Browser Web Extensions
34mAutomate building Chrome Extensions with Antigravity and DevTools MCP