The Native Menace: Host-to-Browser Cross-Boundary Attacks via Native Messaging
Modern browsers are complex software platforms that users can customize through browser extensions to further expand their functionality. Extensions derive their functionality from privileged browser APIs that expose powerful capabilities. Prior work has extensively studied how malicious webpages or extensions can target those capabilities. However, prior research has overlooked the NativeMessaging API, which allows extensions to create a communication channel that bridges the gap between web content rendered in the browser and native apps running on the user's machine. This API enables workflows that cross the browser's boundary to perform critical operations (e.g., digital signing) or exchange sensitive data (e.g., credentials). In this paper, we conduct the first, to our knowledge, empirical security analysis of NativeMessaging, and present a novel attack that allows a non-privileged malicious native app to misuse browsers' native messaging capabilities to stealthily intercept sensitive communications or launch confused deputy attacks against other native apps. To demonstrate the significant risk introduced by native messaging, we present a series of concrete attacks against popular and critical apps (e.g., 1Password, the European Union's eID system, Google Drive), whose browser extensions have more than 532 million cumulative downloads. Our attacks have severe ramifications, including full password vault leakage, and arbitrary document signing in governmental workflows. Fundamentally, these attacks are possible due to native messaging being built on top of an untrusted communication channel without providing a root of trust or enforcing some form of client attestation. Accordingly, we propose a straightforward mitigation technique of message encryption with out-of-band secret sharing, to prevent our attacks.