Injecting a stylesheet with use_dynamic_url set can crash some webpages

[Gaurang Tandon]

Hey all! I ran into a bug with `use_dynamic_url` and wanted to share it with the group to get your thoughts.

If a Chrome extension sets `use_dynamic_url` in `web_accessible_resources` (in manifest.json) and injects a stylesheet, it can crash the host page. We've seen this happen on Google Meet and one other site. There might be more such sites.

Here is the bug report: https://issues.chromium.org/issues/435609878 The bug got closed as "Intended Behavior", which I disagree with. `use_dynamic_url` doesn't document any CSP restrictions. Even then, a webpage crash is an inelegant way to enforce them.

Does anyone have any workarounds or suggestions for this issue?

Cheers,
Gaurang

[PhistucK]

This is insane...

Even doubly insane - extensions are supposed to overcome Content Security Policy restrictions, otherwise they either lose power/become ineffective, or compromise the security/functionality of the website (by disabling the policy altogether, say, or manipulating it in a way that is not guaranteed to be compatible with the website). And a renderer crash as a "by design" behavior of using an extension API... Insane.

☆PhistucK

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/06f1f1cd-dea2-4718-93fc-2cfadbbdc3a2n%40chromium.org.

[Oliver Dunk]

Just to close the loop here, I do think this is a bug and I reopened the report a week or so back.

I'll keep working with the team to make sure we take a look. Thanks for flagging!

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/CABc02_%2B64aeer8FGi__KmquwpcZQYWJtUHh%2BAru%3DKUSuhmdKag%40mail.gmail.com.