Browser extension permission combinations Specific permission-combination fingerprints documented in malicious-extension research (B1-B8).
The existing BrowserDetector
flags any extension that holds at least one risky permission and
emits a single coarse medium-severity finding. The
browser_ext_perms detector runs alongside it on the
same browser-extension artifacts and emits actionable, finer-
grained findings keyed to specific permission combinations
— each is a documented malicious-extension fingerprint.
Detection layers (B1–B8)
| ID | Severity | What it catches | MITRE |
|---|---|---|---|
| B1 | high | nativeMessaging. Pipes stdin/stdout to a host binary registered in NativeMessagingHosts. Legit for 1Password / Bitwarden / browser-tab managers; core primitive for ad-injector / credential-stealer browser malware. | T1071.001 |
| B2 | critical (blocking) / high (read-only) | webRequest or webRequestBlocking + <all_urls>. Intercept / modify every HTTP request. The evil-adblock fingerprint (DataSpii et al). Manifest-V3 deprecates webRequestBlocking — seeing it in 2025+ is notable on its own. | T1557 |
| B3 | high | <all_urls> + cookies + tabs. Session-theft fingerprint — read every site's cookies, identify logged-in sessions, exfil via tab updates. Legit password managers fit this shape; operator confirms. | T1539 |
| B4 | high | proxy. Override Chrome's proxy — route all browser traffic through attacker relay. Rare legit cases (VPN extensions). | T1090 |
| B5 | high | debugger. Attach to other tabs via Chrome DevTools Protocol — read DOM, execute JS, snapshot state. Rarely needed in shipped extensions. | T1056.001 |
| B6 | medium | Spy stack: <all_urls> + tabs + storage + runtime + scripting. Generic surveillance fingerprint. Many legit extensions (LastPass, Honey, Grammarly, AdBlock, uBlock) fit this shape. Suppressed when B2 or B3 already fires. | T1176 |
| B7 | medium | Hardware bridge — usbDevices / printerProvider / vpnProvider / platformKeys. Browser extensions usually don't need physical device access. | T1543 |
| B8 | medium | declarativeNetRequest + ≥20 host patterns. Manifest-V3 cousin of B2 — broad host coverage becomes equivalent surveillance surface. | T1557 |
Stacking
One extension can trip multiple layers — e.g. a single shipped
malicious extension with nativeMessaging +
proxy + debugger emits all three findings.
B6 (spy stack) is the only one that's suppressed when stronger
findings cover it.
No new CLI needed
The detector runs on the existing browser collector's extension
artifacts during digger scan.