2023/08/30 by Asmit Nayak, Rishabh Khandelwal, Nayak, Asmit +3 · 3 voices · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Code (set theory) #Computer science #Computer security #Encryption #Exploit #JavaScript #Operating system #Password #Plaintext #Programming language #Security and Verification in Computing #Set (abstract data type) #Source code #Web Application Security Vulnerabilities #Web application #World Wide Web #cs.CR #cs.CY
paper · pdf · doi:10.48550/arxiv.2308.16321
published in arXiv (Cornell University) (Cornell University)
openalex publication_date 2023/08/30 · openalex created_date 2023/09/03 · openalex updated_date 2026/07/28
In this work, we perform a comprehensive analysis of the security of text input fields in web browsers. We find that browsers' coarse-grained permission model violates two security design principles: least privilege and complete mediation. We further uncover two vulnerabilities in input fields, including the alarming discovery of passwords in plaintext within the HTML source code of the web page. To demonstrate the real-world impact of these vulnerabilities, we design a proof-of-concept extension, leveraging techniques from static and dynamic code injection attacks to bypass the web store review process. Our measurements and case studies reveal that these vulnerabilities are prevalent across various websites, with sensitive user information, such as passwords, exposed in the HTML source code of even high-traffic sites like Google and Cloudflare. We find that a significant percentage (12.5%) of extensions possess the necessary permissions to exploit these vulnerabilities and identify 190 extensions that directly access password fields. Finally, we propose two countermeasures to address these risks: a bolt-on JavaScript package for immediate adoption by website developers allowing them to protect sensitive input fields, and a browser-level solution that alerts users when an extension accesses sensitive input fields. Our research highlights the urgent need for improved security measures to protect sensitive user information online.