<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-02433525</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-19T02:36:40+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">EmPoWeb: Empowering Web Applications with Browser Extensions</title>
            <author role="aut">
              <persName>
                <forename type="first">Dolière Francis</forename>
                <surname>Somé</surname>
              </persName>
              <email type="md5">c4247270662a4167550d86e6ce20f393</email>
              <email type="domain">inria.fr</email>
              <idno type="idhal" notation="numeric">1023856</idno>
              <idno type="halauthorid" notation="string">1271011-1023856</idno>
              <affiliation ref="#struct-122081"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Tamara</forename>
                <surname>Rezk</surname>
              </persName>
              <email type="md5">d1ceba4ebf5093ed92a0c51bffead78f</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2020-01-09 11:05:15</date>
              <date type="whenModified">2025-08-26 15:21:01</date>
              <date type="whenReleased">2020-01-09 14:47:31</date>
              <date type="whenProduced">2019-05-20</date>
              <date type="whenEndEmbargoed">2020-01-09</date>
              <ref type="file" target="https://hal.science/hal-02433525v1/document">
                <date notBefore="2020-01-09"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-02433525v1/file/conference-proceeding.pdf" id="file-2433525-2320616">
                <date notBefore="2020-01-09"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="189265">
                <persName>
                  <forename>Tamara</forename>
                  <surname>Rezk</surname>
                </persName>
                <email type="md5">d1ceba4ebf5093ed92a0c51bffead78f</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-02433525</idno>
            <idno type="halUri">https://hal.science/hal-02433525</idno>
            <idno type="halBibtex">some:hal-02433525</idno>
            <idno type="halRefHtml">&lt;i&gt;SP 2019 - 40th IEEE Symposium on Security and Privacy&lt;/i&gt;, May 2019, San Francisco, United States</idno>
            <idno type="halRef">SP 2019 - 40th IEEE Symposium on Security and Privacy, May 2019, San Francisco, United States</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-2433525-2320616"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="INRIA">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="INRIA-SOPHIA">INRIA Sophia Antipolis - Méditerranée</idno>
            <idno type="stamp" n="INRIASO">INRIA-SOPHIA</idno>
            <idno type="stamp" n="INRIA_TEST">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="TESTALAIN1">TESTALAIN1</idno>
            <idno type="stamp" n="INRIA2">INRIA 2</idno>
            <idno type="stamp" n="UNIV-COTEDAZUR">Université Côte d'Azur</idno>
            <idno type="stamp" n="INRIA_WEB">Inria &amp; web</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">EmPoWeb: Empowering Web Applications with Browser Extensions</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Dolière Francis</forename>
                    <surname>Somé</surname>
                  </persName>
                  <email type="md5">c4247270662a4167550d86e6ce20f393</email>
                  <email type="domain">inria.fr</email>
                  <idno type="idhal" notation="numeric">1023856</idno>
                  <idno type="halauthorid" notation="string">1271011-1023856</idno>
                  <affiliation ref="#struct-122081"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>SP 2019 - 40th IEEE Symposium on Security and Privacy</title>
                  <date type="start">2019-05-20</date>
                  <date type="end">2019-05-22</date>
                  <settlement>San Francisco</settlement>
                  <country key="US">United States</country>
                </meeting>
                <imprint/>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Browser extensions are third party programs, tightly integrated to browsers, where they execute with elevated privileges in order to provide users with additional functionalities. Unlike web applications, extensions are not subject to the Same Origin Policy (SOP) and therefore can read and write user data on any web application. They also have access to sensitive user information including browsing history, bookmarks, credentials (cookies) and list of installed extensions. They have access to a permanent storage in which they can store data as long as they are installed in the user's browser. They can trigger the download of arbitrary files and save them on the user's device. For security reasons, browser extensions and web applications are executed in separate contexts. Nonetheless, in all major browsers, extensions and web applications can interact by exchanging messages. Through these communication channels, a web application can exploit extension privileged capabilities and thereby access and exfiltrate sensitive user information. In this work, we analyzed the communication interfaces exposed to web applications by Chrome, Firefox and Opera browser extensions. As a result, we identified many extensions that web applications can exploit to access privileged capabilities. Through extensions' APIS, web applications can bypass SOP and access user data on any other web application, access user credentials (cookies), browsing history, bookmarks, list of installed extensions, extensions storage, and download and save arbitrary files in the user's device. Our results demonstrate that the communications between browser extensions and web applications pose serious security and privacy threats to browsers, web applications and more importantly to users. We discuss countermeasures and proposals, and believe that our study and in particular the tool we used to detect and exploit these threats, can be used as part of extensions review process by browser vendors to help them identify and fix the aforementioned problems in extensions.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-122081" status="OLD">
          <idno type="RNSR">201019621N</idno>
          <orgName>Secure Diffuse Programming</orgName>
          <orgName type="acronym">INDES</orgName>
          <date type="end">2023-06-30</date>
          <desc>
            <address>
              <addrLine>2004, route des lucioles - BP 93 - 06902 Sophia Antipolis Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www-sop.inria.fr/indes/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-34586" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-34586" status="VALID">
          <idno type="RNSR">198318250R</idno>
          <idno type="ROR">https://ror.org/01nzkaw91</idno>
          <orgName>Centre Inria d'Université Côte d'Azur</orgName>
          <desc>
            <address>
              <addrLine>2004 route des Lucioles BP 93 06902 Sophia Antipolis</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/centre/sophia/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>