Duo Security Digs Into Chrome Extension Security With CRXcavator

guest · Feb 21, 2019

Duo Security Digs Into Chrome Extension Security With CRXcavator
February 21, 2019
https://www.eweek.com/security/duo-security-digs-into-chrome-extension-security-with-crxcavator

Do you know if the Chrome browser extensions that are being used across your enterprise are a potential risk? That's a question that until today wasn't as easy to answer as it should have been.
Cisco's Duo Security business unit is announcing the public beta of a new tool called CRXcavator

"While we did analyze data from the Chrome Web Store, our focus was on trying to learn more about the security properties of the larger browser extension ecosystem and position that information in a way that provided value to organizations and individuals," Josh Yavor, senior manager of corporate security at Duo Security, told eWEEK.

Over the course of January 2019, Duo scanned 120,463 Chrome extensions and apps and found a number of issues that could represent risk. Across the scanned Chrome extensions 38,289 included third-party code libraries that had publicly known vulnerabilities.
The Duo researchers also looked at Oauth authentication grants that could provide access to the user's logged identity from a site, though that wasn't a core focus for the initial research.
Click to expand...

Log in or Sign up

Duo Security Digs Into Chrome Extension Security With CRXcavator

guest Guest

Log in or Sign up

Duo Security Digs Into Chrome Extension Security With CRXcavator

guest Guest

Useful Searches