Google to lock down Chrome extensions

Chrome Web Store apps will be subject to tighter controls

Google is taking action to improve the trustworthiness of the Chrome Web Store, adding new security controls and clamping down on insecure practices.

The Chrome Web Store, which allows users to add extensions to their desktop browser, has a somewhat patchy reputation for security, and has frequently been found to be hosting malicious extensions that silently spy on users and steal their data.

The tech giant is aiming to stamp this out, and is introducing new privacy and security features such as a more stringent permissions system. The new system will allow users to specify if they want to allow extensions to run on all sites, on specific sites, or to only run when the extension is clicked.

The change is part of Google Chrome Version 70, which is due to hit general release this month.

Advertisement - Article continues below
Advertisement - Article continues below

Google is also keeping a closer eye on extensions, effective immediately, and the more permissions an extension asks for, the longer Google will take to review it. The company is placing particular importance on extensions that rely on remotely-hosted code, Chrome Extensions product manager James Wagner said in a blog post, and advised that developers make sure their extensions ask for as few permissions as possible.

Effective immediately, obfuscated code is also banned from the Chrome Web Store altogether. 

"Today over 70% of malicious and policy violating extensions that we block from Chrome Web Store contain obfuscated code," Wagner said. "At the same time, because obfuscation is mainly used to conceal code functionality, it adds a great deal of complexity to our review process. This is no longer acceptable given the aforementioned review process changes."

Extensions that feature obfuscated code will not be allowed to be submitted to the web store, and existing extensions that use it have 90 days to replace it before they are removed.

In addition to the security benefits, the removal of obfuscated code will likely bring performance benefits, as obfuscation usually incurs increased execution times on the host machine.

From next year, the company will also force Web Store extension developers to use two-factor authentication to protect their accounts, with a view to preventing criminals from hacking the accounts of popular extension developers and using their extensions to deliver malware.

Featured Resources

Transform the operator experience with enhanced automation & analytics

Bring networking into the digital era

Download now

Artificially intelligent data centres

How the C-Suite is embracing continuous change to drive value

Download now

Deliver secure automated multicloud for containers with Red Hat and Juniper

Learn how to get started with the multicloud enabler from Red Hat and Juniper

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now



The IT Pro Podcast: Is the future multi-cloud?

29 Nov 2019
Business strategy

Google accused of ‘union busting’

26 Nov 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
public cloud

Vodafone launches 'Neuron' platform with Google Cloud

20 Nov 2019

Most Popular


Patch issued for critical Windows bug

11 Dec 2019
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019

Buy IT to grow, not slow, your business

25 Nov 2019