This sounds like it is Working As Intended. It seems impractical to introduce any sort of taint-tracking that could successfully keep track of whether a given script element was the result of some extension running (e.g. an extension content script which creates a script element in the page which downloads a script over HTTPS; that script block, when run, then postMessage's to itself).

Content Scripts are powerful, and extensions which are allowed to use them are privileged.

Extensions folks, wdyt?

The PoC extension is allowed to inject content scripts into any URL, so effectively they control everything about 'mydomain.com' already, including any delegated trust (by extensions, or otherwise). If an extension with more limited permissions could do this then that would be an escalation, but otherwise I agree with comment 1.

Thanks for the input. I can see your point here. The issue that I was trying to raise is that, victim_ext trusts the content of mydomain.com, however, the content may be tainted if there is a malicious extension in a user's machine that can modify the content of mydomain.com and there is no API for victim_ext to check for such issue. I agree that strictly speaking, this may not be a security issue in Chrome as such, but since I saw a number of extensions making the above assumption, it may be nice to provide an API that allows further checks to be performed. 

Would you say that in this case, the responsibility is with the vendor who trusted content from their own websites? Or with the user who installed an extension with content scripts that can modify pages (which many extensions do these days) Thanks.

> it may be nice to provide an API that allows further checks to be performed.
TL;DR: We do. :)

This sounds very much like a bug in the extensions (and I'd encourage you to please file reports with them!).  We offer a way to handle extension message passing with attribution and stronger guarantees, which is the chrome.runtime.sendMessage API.  Using this API, extensions can *only* message themselves without the handling extension needing to provide special handling (listening to the onMessageExternal vs onMessage event), and differentiating between a message from the extension itself vs from an external party is trivial.

From this bug, it sounds like the issue is that these extensions are actively *not* using the sanctioned API that provides proper attribution and limitations, and are instead relying on content that the page itself (or other content scripts) can easily manipulate.  As elawrence@ mentioned, introducing more advanced taint tracking would be very difficult, and as kenrb@ touched on, any extension with privilege to run on mydomain.com can effectively control mydomain.com.  An additional point here is that changing the behavior of the postMessage method from a content script may break extensions which rely on this emulating a message from the page (which can be legitimate, as one of the main purposes of extensions is to manipulate page content).

I wholeheartedly agree that providing some reasonable attribution in messaging is important, but it sounds like the issue here is that extensions aren't using the proper API (chrome.runtime), which provides some guarantees.*  I don't think there's anything on the chrome-side here that we should change.  For that reason, I'm going to close this out as WontFix, but thank you very much for bringing this up!  And again, I would encourage you to file bugs against extensions you see doing this - it is an insecure practice, for the reasons you've laid out.

*In the extreme case (a compromised renderer), it could lie about its origin - but that's a reasonably high bar (and is also why extensions should always validate message content).

Thanks! I'd file this bug against the extensions themselves in that case. In the meantime, do you mind keeping this ticket hidden so that the extension vendors got a chance to fix things? Thanks.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot