Search code examples
google-chrome-extensionbrowserfingerprint

Why does Chrome itself allow websites to access chrome-extension://*?


The article from here shows a method for websites to determine whether a user has a particular extension installed, if "web_accessible_resources" (in case of Chrome) allows this. My question is why do browsers not filter these requests themselves? The only use case I came up with was to fingerprint the user.


Solution

  • The author of an extension lists such accessible resources in its manifest.json intentionally. This is a feature used by extensions to add a UI or a font/image to the web page(s) and so on.

    Fingerprinting is possible only due to a poor implementation in Chrome (and Chromium-based browsers), which will be eventually fixed in ManifestV3 so extensions can set use_dynamic_url.

    Firefox WebExtensions aren't affected because Firefox uses a unique per-machine UUID, more info.