,
6 tweets,
3 min read
Read on Twitter
"Since Google's stated goal is to make ad blockers safer, The Register asked Google whether any ad blockers have actually abused webRequest. We've not heard back."
theregister.co.uk/2019/06/13/goo…
theregister.co.uk/2019/06/13/goo…
The abuse I've seen repeatedly is not of webRequest API: unethical blockers ripping the code base of legitimate blockers, but with an added permission which allows execution of remote code in extension context.
Just to show how easy it is to stumble onto these, I found another one within seconds (I believe this one uses code base of AdBlock despite "uBlocker" name). 
Another one, using uBO's code.
These extensions give themselves "script-src 'unsafe-eval'" ability in their manifest, i.e. it's programmatically detectable, and yet they pass review.
This is not a new issue, here I was commenting on this two years ago.
This is not a new issue, here I was commenting on this two years ago.
Forbidding extensions using 'unsafe-eval' would have been a good step years ago toward protecting users from unethical extensions.
These would never be allowed in Firefox's AMO: developer.mozilla.org/en-US/docs/Moz…
These would never be allowed in Firefox's AMO: developer.mozilla.org/en-US/docs/Moz…
