Can uBlock Origin extension read LastPass extension password?

[Calvin Craig]

Can the uBlock Origin extension (one of whose permissions indicates "[Can] Read and change all your date on the websites you visit") read the password entered into the LastPass extension?

Also, can it read passwords entered by LastPass on web pages?

Thanks!

[Antony Sargent]

On Tue, Sep 15, 2015 at 8:16 AM, Calvin Craig <calvind...@gmail.com> wrote:

Can the uBlock Origin extension (one of whose permissions indicates "[Can] Read and change all your date on the websites you visit") read the password entered into the LastPass extension?

Probably not. In general we try to keep extensions isolated from each other are they aren't allowed to do things like inject content scripts into other extensions, although they are allowed to mutually opt in to communication with each other. There are caveats though to this isolation - for instance the debugger, tabCapture, and webRequest APIs might let one extension see some of the behavior or on-screen UI of other extensions. 

 

Also, can it read passwords entered by LastPass on web pages?

Yes, possibly. It probably doesn't currently have code that does this, but in general any extension that injects content scripts into a given page can observe what goes on in that page, so you should think carefully whether you trust a developer before installing their extension. 

 

Thanks!

--
You received this message because you are subscribed to the Google Groups "Chromium-extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To post to this group, send email to chromium-...@chromium.org.
Visit this group at http://groups.google.com/a/chromium.org/group/chromium-extensions/.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/d5163421-e671-4c1b-a956-5dfc40790cb2%40chromium.org.
For more options, visit https://groups.google.com/a/chromium.org/d/optout.