Chromium-Based Browsers in Windows Domains Vulnerable to Arbitrary Extension Loads

A new study has shown that Chromium-based browsers in Windows domain environments are vulnerable to arbitrary extension loads. By manipulating where Chrome and related browsers store extension settings in preference files, attackers can silently inject code that loads extensions at startup, without triggering visible warnings.

The researchers validated the attack on Chromium version 130 and demonstrated that a single disk write can bypass standard safeguards to achieve persistent, stealthy access, with MACs protecting extension entries and developer-mode checks being bypassed.

The technique involves pre-calculating the extension ID, generating valid MACs, and overwriting the JSON settings, while domain policy bypass methods can spoof an approved extension ID to sidestep allowlists, a tactic called “extension stomping.” Administrators’ policies stored in HKCU can also be deleted or altered by any process with elevated rights, undermining enforcement.

Detecting unsigned writes to preference files, watching for unexpected developer-mode changes, and auditing HKCU\\Software\\Policies\\Google\\Chrome are urged to help mitigate the risk, according to the Phantom extension backdooring Chrome through uncharted pathways.