# Kaspersky Protection extension for Google Chrome is vulnerable to abuse its features

Kaspersky Protection Chrome extension's web-accessible warning page accepts unauthenticated postMessage, letting any website trigger uninstall of extensions including itself.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-11-25
- CVE: CVE-2019-15684
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/470519
- Library page: https://bugbountylibrary.com/r/h1%3A470519
- Tags: area:os domain:browser impact:integrity kind:bounty platform:hackerone sev:medium tech:chromium technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Chrome extension web-accessible warning page / postMessage handler
**Root cause:** The extension's warning page is marked web_accessible and receives the target extension ID via postMessage without validating the sender origin, so any site can drive the uninstall flow.
**Steps:**
1. Install Kaspersky Protection and Adblock Plus in Chrome.
2. Open attacker page `remove_extension.html` that frames the web-accessible warning page and sends a `postMessage()` with the target extension ID.
3. Click on the page; Chrome shows a removal prompt attributed to Kaspersky Protect.
4. For self-removal, open `remove_self.html` which targets Kaspersky Protection's own ID; click and the extension is uninstalled with no confirmation prompt.
**How found:** Noticed the warning page was web_accessible and that it consumed postMessage data without origin checks, then tested framing it from an arbitrary page.
**Exploitation:** Attacker hosts a page that embeds the web-accessible warning frame and posts a message naming the victim extension ID; a user click triggers Chrome's uninstall prompt (or silent removal for Kaspersky itself), stripping protection.
**Escalation:** Social engineering the confirmation prompt to remove other security extensions; self-uninstall removes all protection with no recovery path.
**Insight:** Enumerate web_accessible_resources of security extensions and check whether their message handlers validate event.origin; pages that drive privileged actions (uninstall, block, scan) are prime targets for cross-origin postMessage abuse.