How can a browser extension provide persistence?¶
A browser extension can provide persistence by remaining installed and operating whenever the browser or user profile is active.
Avoid the dangerous assumption¶
The dangerous assumption is that an extension available through an official store must be safe or authorised.
It may be malicious, compromised, impersonated or abused after installation.
An extension may access:
- webpages
- form data
- cookies
- browser history
- downloads
- clipboard content
- authentication sessions
- page content.
The exact capability depends on permissions and browser behaviour.
Investigators should preserve:
- extension name and stable identifier
- version
- source of installation
- installation time
- permissions
- publisher details
- configuration
- update history
- browser profile
- network connections
- account or device policies
- evidence of use.
Do not rely only on the displayed name or icon.
A malicious extension may imitate a legitimate product.
An extension can also be installed by organisational policy, another application or a compromised browser account.
The presence of broad permissions does not prove every capability was used.
Likewise, removal of the extension may not remove data already collected or account changes already made.
Current browser and store behaviour should be verified where a specific technical claim matters.
Extensions may synchronise across browsers or devices through a user account. Establish whether installation occurred locally, through account synchronisation or by organisational policy, because the apparent installation device may not be the original source.
Browser updates can change extension behaviour or permissions, so preserve the version and manifest that applied during the incident.
Operational takeaway¶
Identify the extension, permissions, installation route and actual browser activity, and preserve the profile before removal changes the evidence.