A toolkit with the implementation of a method for detecting extensions installed in the Chrome browser has been published. The obtained list of extensions can be used to increase the accuracy of passive identification of a specific browser instance, combined with other indirect signs such as screen resolution, WebGL features, and lists of installed plugins and fonts. The proposed implementation checks for the installation of over 1000 extensions. An online demo is suggested for verifying your system.
The detection of extensions is performed by analyzing the resources provided by the extensions that are accessible to external requests. Typically, extensions include various accompanying files, such as images, which are specified in the extension's manifest under the property web_accessible_resources. In the first version of the Chrome manifest, access to resources was not restricted, and any website could load the provided resources. In the second version of the manifest, access to such resources was by default only permitted for the extension itself. In the third version of the manifest, it became possible to specify which resources can be served to which extensions, domains, and pages.
Web pages can request resources supplied by extensions using the fetch method (for example, 'fetch("chrome-extension://okb….nd5/test.png")'), with a return value of 'false' usually indicating that the extension is not installed. To block detection of the extension based on resource availability, some extensions generate a verification token required for accessing the resource. A fetch call without specifying the token always fails.
It turns out that access protection to extension resources can be bypassed by measuring the execution time of the operation. Although fetch called without a token always returns an error, the execution time for operations differs with and without the extension — if the extension is present, the request will take more time than if the extension is not installed. By measuring the reaction time, one can fairly accurately determine the presence of the extension.
Some extensions that do not include externally accessible resources can be identified by their additional properties. For example, the MetaMask extension can be identified through the assessment of the property window.ethereum (if the extension is not installed, 'typeof window.ethereum' will return 'undefined').
Source: opennet.ru
