Thanks for the report! Yes, it's in the right place, and we'll have a look.

I've reviewed the paper, thanks. I don't see anything here that is a surprise. The "malicious" extension you've linked does not request a significant level of permissions and thus I would not expect it to be able to exercise most of the capabilities discussed in your paper. Your paper does not identify any circumstances where you found that the extension's capabilities exceeded the requested and granted permissions, so I trust you have not identified such a flaw?

In a quick scan of the prose itself, I noted a few things:

> (In practice, phishing websites rarely use
certificates as they are usually very short-lived; furthermore,
a certificate is costly to obtain and requires checking the
identity.) 

This is no longer true; see e.g. https://textslashplain.com/2017/01/16/certified-malice/ for discussion.

> The browser must warm the user if there is any abnormality in the certificate

Typo: warm -> warn

Elsewhere in the paper, there's discussion of replacing a legitimate site with a phishing site (e.g. Phishbook) -- it's unclear why an attacker would bother doing this, given that his full-privilege extension could simply watch the user's input into the legitimate site. The attacker need not build any phishing content at all unless he wishes to collect data the legitimate site does not request.

Hi,

That's correct, we haven't identified such flaws in Chrome, the paper is a survey paper and is meant to detail the threats present with extensions, rather than identify security flaws with the implementation of your extension system. 

Thanks for the feedback, that was an interesting article (and something that has been fixed in our rescheduled version). The idea of introducing various attacks is to enumerate all the possibilities an attacker may have in evading automated vetting processes. 

Out of curiosity what is Chrome's philosophy on dealing with  the threat of malicious extensions, and with the web store not being able to 100% vet all malicious extensions? 

You can read about Web Store guidelines here: https://developer.chrome.com/webstore/program_policies

I'm not aware of any other public statements beyond our blogs: See https://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html and the places it links).

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot