Google to lock down Chrome extensions

Chrome Web Store apps will be subject to tighter controls

Google is taking action to improve the trustworthiness of the Chrome Web Store, adding new security controls and clamping down on insecure practices.

The Chrome Web Store, which allows users to add extensions to their desktop browser, has a somewhat patchy reputation for security, and has frequently been found to be hosting malicious extensions that silently spy on users and steal their data.

The tech giant is aiming to stamp this out, and is introducing new privacy and security features such as a more stringent permissions system. The new system will allow users to specify if they want to allow extensions to run on all sites, on specific sites, or to only run when the extension is clicked.

The change is part of Google Chrome Version 70, which is due to hit general release this month.

Google is also keeping a closer eye on extensions, effective immediately, and the more permissions an extension asks for, the longer Google will take to review it. The company is placing particular importance on extensions that rely on remotely-hosted code, Chrome Extensions product manager James Wagner said in a blog post, and advised that developers make sure their extensions ask for as few permissions as possible.

Effective immediately, obfuscated code is also banned from the Chrome Web Store altogether. 

"Today over 70% of malicious and policy violating extensions that we block from Chrome Web Store contain obfuscated code," Wagner said. "At the same time, because obfuscation is mainly used to conceal code functionality, it adds a great deal of complexity to our review process. This is no longer acceptable given the aforementioned review process changes."

Extensions that feature obfuscated code will not be allowed to be submitted to the web store, and existing extensions that use it have 90 days to replace it before they are removed.

In addition to the security benefits, the removal of obfuscated code will likely bring performance benefits, as obfuscation usually incurs increased execution times on the host machine.

From next year, the company will also force Web Store extension developers to use two-factor authentication to protect their accounts, with a view to preventing criminals from hacking the accounts of popular extension developers and using their extensions to deliver malware.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Biden nominees highlight tough cyber security challenges
cyber security

Biden nominees highlight tough cyber security challenges

20 Jan 2021
Report: Security staff excluded from app development
cyber security

Report: Security staff excluded from app development

20 Jan 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

20 Jan 2021
SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021

Most Popular

Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021