Security Polymorphic browser extensions - password managers under attack

eva2000 · May 10, 2025

Your password manager is under attack, and this new threat makes it worse: How to defend yourself

Basically a bait and switch browser extension

On the one hand, if the tech industry has its way -- to abolish all passwords and replace them with passkeys -- users will eventually have almost no choice but to rely on password managers for signing in to their favorite sites and apps. Yes, the days of committing user IDs and passwords to memory or cryptically scratching your passwords into an old day planner are numbered.

On the other hand, malicious actors are the lions at our gate. All the password management solution providers ZDNET spoke with acknowledge that they're under constant attack by hackers trying to access the proverbial keys to the kingdom and the riches they protect
Click to expand...

"Password managers are high-value targets and face constant attacks across multiple surfaces, including cloud infrastructure, client devices, and browser extensions," said NordPass PR manager Gintautas Degutis. "Attack vectors range from credential stuffing and phishing to malware-based exfiltration and supply chain risks."

Googling the phrase "password manager hacked" yields a distressingly long list of incursions. Fortunately, in most of those cases, passwords and other sensitive information were sufficiently encrypted to limit the damage.

Earlier this year, Picus Security published research indicating that hackers are redoubling their efforts to break into password managers. According to a release from the firm, "25% of malware [now] targets credentials in password stores -- a 3X increase from 2023."
Click to expand...

Picus Security co-founder Süleyman Özarslan noted that "threat actors are leveraging sophisticated extraction methods, including memory scraping, registry harvesting, and compromising local and cloud-based password stores, to obtain credentials that give attackers the keys to the kingdom." Threat actors are leaving no stone unturned in hopes of breaking into your password manager.
Click to expand...

A new and terrifying threat
One of the most recent and terrifying threats to make headlines came from SquareX, a company selling solutions that focus on the real-time detection and mitigation of browser-based web attacks. SquareX spends a great deal of its time obsessing over the degree to which browser extension architectures represent a potential vector of attack for hackers.
Click to expand...

In the course of trying to discover certain browser extension vulnerabilities before malicious actors do, SquareX announced in February that it found a sneaky way for a malicious Chrome extension to impersonate 1Password's password management extension. Although the announcement sounds like bad news for Chrome and 1Password users, it's actually much worse. The discovery is relevant to all password managers on Chrome, and it's relevant to all extensions on all popular browsers.

SquareX didn't single out Chrome or 1Password because it found them to be inherently more vulnerable than other browsers or password managers -- or other extensions for that matter. "We picked Chrome as it's the most used browser both within enterprise and in the B2C space," said SquareX founder Vivek Ramachandran in an interview with ZDNET.
Click to expand...

How impostor extensions do their dirty work
It tricks users into working with an impostor extension.

A polymorphic extension is a browser extension that lures you to install it with one advertised benefit, but then morphs into a different extension that convincingly portrays itself as one of the legitimate extensions you've already installed (e.g., your password manager). From a social engineering perspective, it bears a strong resemblance to phishing and smishing. In one of two initial forms that the attack can take, it evades detection by temporarily disabling the legitimate extension without uninstalling i
Click to expand...

On first blush, the idea that one browser extension could be so disruptive to another extension sounds like the type of software boundary violation any reasonable browser should block as a part of its security architecture. Take Chrome: When a browser extension is first added to the Chrome Web Store, the developer must declare a manifest of permissions that end-users are warned about before that extension can be installed.

For example, according to Google's list of permissions that developers can include in their manifests, if a developer declares that an extension needs access to Chrome's notifications API, the text "Display notifications" will automatically be included in the preinstallation warning seen by users, as shown in the screenshot below:
Click to expand...

According to Ramachandran, the list of permissions is too complicated for regular users to make an informed decision, thus increasing the likelihood that a threat actor might get approval for an all-seeing, all-knowing browser "superpower."

Several of the permissions that qualify as superpower permissions are ones that most Chrome extensions, including password managers, shouldn't be asking for. One of those -- the permission for Chrome's chrome.management API (with Firefox, it's the browser management API) -- is the permission that affords one extension the right to manipulate other extensions.
Click to expand...

Once the developer of an extension has access to the chrome.management API, not only can they morph their own extension into something else, they can disable other ones and unpin them from the browser's toolbar without detection by the user. In fact, access to the chrome.management API also gives hackers the ability to fully uninstall other extensions.
Click to expand...

Once the malicious extension detects that the user is about to log into a website (which only requires the ability to examine the contents of the current web page), it uses the chrome.management API to disable the legitimate extension and unpin its icon from Chrome's toolbar, as shown below.
Click to expand...

By this point, the polymorphic extension will have morphed into an extension that looks and feels like the legitimate extension (reminiscent of how phishing websites impersonate legitimate sites). From there, the malicious extension prompts the unsuspecting user for the credentials to their 1Password account (remember, it could be any password manager) and phones home to the hacker with the newly exfiltrated information.

Then, to clean up after itself, it re-enables the legitimate extension, restores the pinned icons to their original state, and even completes the sign-in process with whatever website the user was authenticating with.

In case the polymorphic extension is unable to garner the user's permission for access to the chrome.management superpower, Ramachandran says there's a contingency plan where it can just as easily pop up a browser window that looks and feels a lot like one of your legitimate extensions.
Click to expand...

However, in terms of additional factors of authentication, users should be cautious about having one-time passcodes (OTPs) sent to an email inbox that's open in one of their browser tabs. An extension with the common permission to "Read and change all your data on all websites" could theoretically intercept an OTP that appears on that tab.
Click to expand...

Log in / Register

Forums

Welcome to Centmin Mod Community

Security Polymorphic browser extensions - password managers under attack

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Security Polymorphic browser extensions - password managers under attack

eva2000 Administrator Staff Member

.