# Google Extensions (Awarded $18833.7)

Multiple Google Chrome extensions trusted attacker-controlled origins in externally_connectable or message listeners, enabling RCE, SOP bypass, and credential leaks.

- Payout: $18,834
- Severity: high
- Program: Google, Proton AG
- Credited: NDevTK
- Disclosed: 2023-08-18
- Write-up quality: 8/10
- Original: https://ndevtk.github.io/writeups/2023/08/18/extensions/
- Library page: https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions
- Tags: domain:browser impact:data-leak impact:rce kind:bounty platform:blog sev:high tech:chromium technique:chained technique:source-review vuln:access-control vuln:info-disclosure vuln:rce vuln:secrets-leak

**Target:** Chrome extensions (Application Launcher for Drive, Perfetto UI, Screen Reader, Tag Assistant, Secure Shell, Proton Pass)
**Root cause:** Extensions trusted attacker-controllable origins (storage.googleapis.com, any *.google.com, or no origin check on postMessage) in externally_connectable or message listeners, letting any page invoke privileged extension APIs.
**Steps:**
1. Enumerate extension IDs and download CRX sources via clients2.google.com update2 endpoint, beautify with prettier
2. Grep for .onMessage/.onConnect/.onMessageExternal and externally_connectable matches
3. For Application Launcher for Drive: from any http://*.google.com page run `chrome.runtime.connect('lmjegmlicamnimmfhcmpkclmigmmcbeh',{name:'com.google.drive.nativeproxy'})` then postMessage `native_opener/v2/3/<b64>` to open a shared Drive file
4. For Perfetto UI: host page on storage.googleapis.com, connect to extension `lfmkphfpdbjijhpomgecfikhfohaoine`, postMessage `{method:'GetCategories'}` and drive trace recording to exfil netlog tokens
5. For Screen Reader: `win.postMessage('cvox.PortSetup','*',[port])` then postMessage JSON `{cmd:'clickNodeRef',args:[{cvoxid:'"], '+selector+', *[x="'}]}` to click cross-origin DOM
6. For Proton Pass: from content script context send `chrome.runtime.sendMessage({type:'EXPORT_REQUEST',payload:{encrypted:false}})` to dump plaintext vault
**How found:** Bulk-downloaded and beautified Google extension sources, grepped for message listeners and externally_connectable entries, flagged unsafe origins like storage.googleapis.com and http://*.google.com, then audited message handlers for missing sender/origin checks.
**Exploitation:** Attacker page hosted on a trusted origin (e.g. storage.googleapis.com bucket or any http google subdomain) connects to the extension's externally_connectable port or postMessage listener and invokes privileged commands: opening arbitrary Drive files (RCE via VBS), recording browser traces containing Authorization tokens, clicking cross-origin DOM to auto-grant OAuth, or exporting all Proton Pass passwords in plaintext.
**Escalation:** Chained SOP bypass to automated OAuth permission grant; used compromised renderer to reach content-script context and leak URLs/tokens; Secure Shell WAR embedding led to ChromeOS crosh shell and Linux container access (mic capture, file read/write).
**Insight:** externally_connectable matches on shared multi-tenant origins (storage.googleapis.com, *.google.com) are effectively open to any attacker; also postMessage listeners without event.origin checks in content scripts let any page drive privileged extension commands cross-origin.