Malicious Firefox Extensions
Abstract
The purpose of this paper is to warn Mozilla Firefox users about the risk associated with browser extensions, especially the fact that Firefox extensions are more dangerous than ActiveX controls in Internet Explorer. Interestingly, the lack of security of ActiveX controls is well known whereas the security of Firefox extensions seems to be ignored. This danger is platform-independant, Microsoft Windows as well as Mac OS and Linux are vulnerable as long as Firefox is used. Finally, we only consider Firefox but virtually every Mozilla application implementing an extension mechanism is subject to this threat, such as Thunderbird.