The Design And Implementation Of Browser Extension Vulnerability Detecting Tool

Browser extension is a mechanism used to improve the performance andapplicability of browsers by adding new personalization features, and it greatlyfacilitates users to modify their browsers to a variety of styles. However, extensionmechanism may also introduce more security related vulnerabilities. Though thethreats of malicious or vulnerable extensions have been addressed by several solutions,these solutions are still far from eliminating the threats, especially when theextensions’ behavior sequences are unsafe.After a large-scale study to the behaviors of Firefox browser extensions, usingFirefox as an example, this paper provided an approach firstly to synthesize abstractbehavioral models from XPCOM（Cross Platform Component Object Model）interfaces, invoking sequences of extensions obtained by the run-time interfaceinvoking approach, which requires the preparatory implementation of a behaviormonitoring system. Secondly, it purposes to define the vulnerable behavior sequencepatterns that are used to guide the testing process adopted on sequence matchingmethods for detecting the security and reliability vulnerability of extensions. Theeffectiveness and performance of our approach and detecting tool is provided with thesupport of experimental results.Through the experiment and the analysis on it, the effectiveness of the approachprovided has been verified, and although, the further research and improving directionis found. The efficiency improvement and more sophisticated definitions onvulnerable behavior sequence are needed in the future.