{"id":104458,"date":"2022-06-21T03:36:39","date_gmt":"2022-06-21T01:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-instrumentarij-dlya-opredeleniya-dopolnenij-ustanovlennyh-v-chrome"},"modified":"2022-06-21T03:36:39","modified_gmt":"2022-06-21T01:36:39","slug":"opublikovan-instrumentarij-dlya-opredeleniya-dopolnenij-ustanovlennyh-v-chrome","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/opublikovan-instrumentarij-dlya-opredeleniya-dopolnenij-ustanovlennyh-v-chrome","title":{"rendered":"A toolkit for detecting extensions installed in Chrome has been published.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A toolkit with the implementation of a method for detecting extensions installed in the Chrome browser has been published. The obtained list of extensions can be used to increase the accuracy of passive identification of a specific browser instance, combined with other indirect signs such as screen resolution, WebGL features, and lists of installed plugins and fonts. The proposed implementation checks for the installation of over 1000 extensions. An online demo is suggested for verifying your system. <\/p>\n
The detection of extensions is performed by analyzing the resources provided by the extensions that are accessible to external requests. Typically, extensions include various accompanying files, such as images, which are specified in the extension's manifest under the property web_accessible_resources. In the first version of the Chrome manifest, access to resources was not restricted, and any website could load the provided resources. In the second version of the manifest, access to such resources was by default only permitted for the extension itself. In the third version of the manifest, it became possible to specify which resources can be served to which extensions, domains, and pages. <\/p>\n
Web pages can request additional resources using the fetch method (for example, fetch('chrome-extension:\/\/okb...nd5\/test.png'), with a return value of 'false' usually indicating that the extension is not installed. To block detection of the extension based on the presence of resources, some extensions generate a verification token required to access the resource. A fetch call without specifying a token always fails. <\/p>\n
It turns out that access protection for extension resources can be bypassed by evaluating the operation's execution time. Although fetch always returns an error when requesting without a token, the execution time differs when the extension is present versus when it is absent \u2014 if the extension is present, the request takes longer than if the extension is not installed. By measuring the response time, it is possible to fairly accurately determine the presence of the extension. <\/p>\n