🤖 AI Summary
This study systematically uncovers, for the first time, security risks arising from JavaScript (JS) inclusions in Chrome extensions—highlighting critical environmental differences from regular web contexts and a longstanding lack of comprehensive empirical analysis. To address this gap, we propose a hybrid static-dynamic analysis framework: static analysis combines abstract syntax tree (AST) parsing with inter-procedural data-flow path tracing; dynamic analysis integrates runtime script-injection detection and network request monitoring. Applied to 36,324 real-world extensions, our framework identifies 350,784 JS inclusions, confirms 22 exploitable remote script loading vulnerabilities, and reveals widespread reliance on high-risk, outdated libraries (e.g., jQuery 1.x, Underscore 1.4.x) across mainstream extensions. These findings fill a critical gap in browser extension JS supply-chain security research and provide an empirical foundation and methodological support for extension vetting, automated vulnerability detection, and security governance.
📝 Abstract
JavaScript, a scripting language employed to augment the capabilities of web browsers within web pages or browser extensions, utilizes code segments termed JavaScript inclusions. While the security aspects of JavaScript inclusions in web pages have undergone substantial scrutiny, a thorough investigation into the security of such inclusions within browser extensions remains absent, despite the divergent security paradigms governing these environments. This study presents a systematic measurement of JavaScript inclusions in Chrome extensions, employing a hybrid methodology encompassing static and dynamic analysis to identify these inclusions. The analysis of 36,324 extensions revealed 350,784 JavaScript inclusions. Subsequent security assessment indicated that, although the majority of these inclusions originate from local files within the extensions rather than external servers, 22 instances of vulnerable remote JavaScript inclusions were identified. These remote inclusions present potential avenues for malicious actors to execute arbitrary code within the extension's execution context. Furthermore, an analysis of JavaScript library utilization within Chrome extensions disclosed the prevalent use of susceptible and outdated libraries, notably within numerous widely adopted extensions.