Skip to content
NewA calmer, faster ZeroHour
Researchinfo

NativeMessaging enables host-to-browser cross-boundary attacks

Original title: The Native Menace: Host-to-Browser Cross-Boundary Attacks via Native Messaging

arXiv cs.CRby Jyotirmay Chauhan ()1 min read
Read at arxiv.org
AI summary · x-ai/grok-4.7Summaries by Vani AI

Non-privileged malicious native apps misuse the NativeMessaging API to intercept sensitive data or launch confused deputy attacks against browser extensions with over 532 million cumulative downloads.

NativeMessaging bridges web content and native machine apps without a root of trust. The paper presents empirical analysis and concrete attacks against popular apps such as 1Password, the EU eID system, and Google Drive. Proposed mitigation uses message encryption with out-of-band secret sharing.

Key facts
  • Attacks enable full password vault leakage and arbitrary document signing
  • Native messaging built on untrusted channel without client attestation
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
native-messagingbrowser-extensionscross-boundaryconfused-deputy
Products
NativeMessaging

From the original article

1 min read at arxiv.org

Modern browsers are complex software platforms that users can customize through browser extensions to further expand their functionality. Extensions derive their functionality from privileged browser APIs that expose powerful capabilities. Prior work has extensively studied how malicious webpages or extensions can target those capabilities.

arXiv cs.CR

By Jyotirmay Chauhan · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.