Google to lock down Chrome extensions

Chrome Web Store apps will be subject to tighter controls

Google is taking action to improve the trustworthiness of the Chrome Web Store, adding new security controls and clamping down on insecure practices.

The Chrome Web Store, which allows users to add extensions to their desktop browser, has a somewhat patchy reputation for security, and has frequently been found to be hosting malicious extensions that silently spy on users and steal their data.

The tech giant is aiming to stamp this out, and is introducing new privacy and security features such as a more stringent permissions system. The new system will allow users to specify if they want to allow extensions to run on all sites, on specific sites, or to only run when the extension is clicked.

The change is part of Google Chrome Version 70, which is due to hit general release this month.

Google is also keeping a closer eye on extensions, effective immediately, and the more permissions an extension asks for, the longer Google will take to review it. The company is placing particular importance on extensions that rely on remotely-hosted code, Chrome Extensions product manager James Wagner said in a blog post, and advised that developers make sure their extensions ask for as few permissions as possible.

Effective immediately, obfuscated code is also banned from the Chrome Web Store altogether. 

"Today over 70% of malicious and policy violating extensions that we block from Chrome Web Store contain obfuscated code," Wagner said. "At the same time, because obfuscation is mainly used to conceal code functionality, it adds a great deal of complexity to our review process. This is no longer acceptable given the aforementioned review process changes."

Extensions that feature obfuscated code will not be allowed to be submitted to the web store, and existing extensions that use it have 90 days to replace it before they are removed.

In addition to the security benefits, the removal of obfuscated code will likely bring performance benefits, as obfuscation usually incurs increased execution times on the host machine.

From next year, the company will also force Web Store extension developers to use two-factor authentication to protect their accounts, with a view to preventing criminals from hacking the accounts of popular extension developers and using their extensions to deliver malware.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

What is DevSecOps and why is it important?
Security

What is DevSecOps and why is it important?

30 Oct 2020
Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle
Security

Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle

30 Oct 2020
Apple reportedly ramps up search engine development
iOS

Apple reportedly ramps up search engine development

29 Oct 2020
Ryuk behind a third of all ransomware attacks in 2020
Security

Ryuk behind a third of all ransomware attacks in 2020

29 Oct 2020

Most Popular

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020
What is Neuralink?
Technology

What is Neuralink?

24 Oct 2020
Hackers demand ransom from therapy patients after clinic data breach
Security

Hackers demand ransom from therapy patients after clinic data breach

27 Oct 2020