Vivek Ramachandran & Shourya Pratap Singh: Hidden Extensions — Bypassing Chrome MV3 Protections
A DEF CON 32 talk where security researchers Vivek Ramachandran and Shourya Pratap Singh analyze weaknesses in Chrome’s Manifest V3 (MV3) extension security model.
Despite being designed to improve security, MV3 can still be bypassed. The speakers demonstrate attacks where malicious extensions silently access the webcam, audio, clipboard, and even data from other extensions — including password managers.
The talk also shows ways to achieve arbitrary code execution despite MV3 restrictions and proposes improvements to strengthen the extension security model.
Despite being designed to improve security, MV3 can still be bypassed. The speakers demonstrate attacks where malicious extensions silently access the webcam, audio, clipboard, and even data from other extensions — including password managers.
The talk also shows ways to achieve arbitrary code execution despite MV3 restrictions and proposes improvements to strengthen the extension security model.