how to detect if any web extensions are being used

Question

I want to detect using vanilla javascript if the end-user has any webextensions enabled at all. Is there a way to query for a list of browser enabled webextensions? Hopefully there is another way besides checking for injected scripts, css and image tags that the page was never intended to load.

This question was shut down for not entering enough security reasons. I can understand why that's a concern but it is not a reason to burn a technical question. Regardless, here are security reasons to want to eliminate web-extensions from a website:

web-extensions allow people to break CSP https://chrome.google.com/webstore/detail/disable-content-security/ieelmcmcagommplceebfedjlakkhpden

scrape your business data, install key loggers to harvest passwords and other information, install image tracking beacons to track private and sensitive end-user information - all unbeknownst to your average end-user.

In addition, deliberate or self-made web-extensions can automate scraping your business data, attempt to spoof captcha logins and other malicious purposes.

In a *general* way, not that I'm aware of (which isn't saying much). In *specific* ways (specific to browser + extension combos), yes, although I only know about Chrome/Firefox research. — Dave Newton, Oct 06 '20 at 15:32
anyway, you should never restrict how user use your website, (and you'll never success (say user open devtool and do a self-xss )) — apple apple, Oct 06 '20 at 15:32
@user1709076 and I'm saying you're doing it wrong and you'll never sucecss — apple apple, Oct 06 '20 at 15:34
plus there would be future reader, My comment is meaningful for them even if not you — apple apple, Oct 06 '20 at 15:35
I vote to close as there is no threat model mentioned in question. and there shows no attempt. — apple apple, Oct 06 '20 at 15:37
threat model is easy. CSP and web image beacon and stuff like this: https://chrome.google.com/webstore/detail/disable-content-security/ieelmcmcagommplceebfedjlakkhpden — user1709076, Oct 06 '20 at 15:50

score 1 · Answer 1 · answered Oct 06 '20 at 15:27

1

some way is

you can check number of script tag that document has (also css)

then if there were more than your resource

user use extension

... some extension does not add script or css

answered Oct 06 '20 at 15:27

hossein sedighian

1,711
1
13
16

As you state, many extensions don't modify page source or page CSS, so the number of extensions that would be caught by this would fall far short. – Dave Newton Oct 06 '20 at 15:33
i like this idea if you add searching for tags as well since often a web beacon is installed to track the user unknowingly – user1709076 Oct 06 '20 at 15:46

how to detect if any web extensions are being used

1 Answers1