Extensions in Google Chrome are open to a password-stealing hack, according to a security researcher.
Because such third-party add-ons have access to the document object model (DOM) in the Chrome browser - a key API which manages information - it is possible to create an extension that can read form fields and gather passwords and logins, said Andreas Grech in a blog post.
Grech created a "simple" proof of concept plug-in that stripped such data from well-known web pages as the user logged in, and then emailed it back to him. The flaw works against sites including Gmail, Facebook and Twitter, the researcher claimed.
"Whenever a user submits a form, it tries to capture the username and password fields, sends me an email via an Ajax call to a script with these login details, along with the URL, and then proceeds to submit the form normally as to avoid detection," Grech wrote.
Grech said the technique could also be used to steal cookies and other browser data. "The point I am trying to make here is that you should always be careful about what third-party applications you install," he said.
Google hadn't returned our request for comment regarding the flaw at the time of publication
