Google is tightening up security for Chrome extensions in an effort to prevent malicious extensions from getting into its web store. Starting from January next year, Google will require all extensions in stable or download the beta products only from Chrome Web Store. Currently, users can install extension from anywhere which makes it quite easy for adversaries to publish malicious extensions.
Mike Bittner, Digital Security & Operations Manager of The Media Trust commented below as part of our security experts comments series.
Mike Bittner, Digital Security & Operations Manager at The Media Trust:
“Google’s decision to tighten their security policies for their Chrome Store is an important step in the right direction. Too often, developers pay little or no attention to security during the development process. In the post-GDPR world, these security lapses can cost all parties along the supply chain that process consumer data. Google’s five new rules are a good faith effort to reduce those risks, they but do not get developers off the security hook. That’s because even if extensions do not use obfuscated code or are subject to closer scrutiny by Google, attacks can spread through poorly secured extensions, and phishing attacks can bypass two-factor authentication. Another important point is that Chrome users should turn on “auto updates” to ensure they benefit from Chrome 70’s improved security as soon as it’s available.”
