Full Report
API keys, secrets, and tokens commonly left exposed in browser extensions’ code.
Analysis Summary
# Vulnerability: Hardcoded Secrets in Chrome Browser Extensions
## CVE Details
- **CVE ID:** N/A (This summary addresses multiple architecture/implementation flaws rather than a single CVE-tracked vulnerability)
- **CVSS Score:** N/A (Severity is based on the *potential* impact of the exposed secret, which varies)
- **CWE:** CWE-798: Use of Hard-coded Credentials
## Affected Systems
- **Products:** Numerous publicly available Chrome Extensions including:
- Avast Online Security & Privacy (7M+ users)
- AVG Online Security (600K+ users)
- Equatio – Math Made Digital (5M+ users)
- Awesome Screen Recorder & Screenshot (3M+ users)
- Scrolling Screenshot Tool & Screen Capture (400K+ users)
- Microsoft Editor – Spelling & Grammar Checker (2M+ users)
- Antidote Connector (1M+ users)
- Watch2Gether (1M+ users)
- Trust Wallet (1M+ users)
- Speed Dial [FVD] - New Tab Page, 3D, Sync (500K+ users)
- SellerSprite - Amazon Research Tool (400K+ users)
- TravelArrow - Your Virtual Travel Agent (300K+ users)
- Over 90 extensions utilizing the vulnerable InboxSDK library.
- **Versions:** Unspecified vulnerable versions prior to patching.
- **Configurations:** Any installation of the listed extensions where the hardcoded secret remains present in the client-side JavaScript code.
## Vulnerability Description
The core vulnerability is the **hardcoding of sensitive API keys, secrets, and tokens directly within the client-side JavaScript source code** of numerous popular browser extensions. Because browser extension packages are easily inspectable by end-users, these secrets are exposed in plain text.
Specific exposed secrets include:
1. **Google Analytics 4 (GA4) API secrets** (Avast, AVG, SellerSprite, Speed Dial) capable of data pollution/cost inflation.
2. **Microsoft Azure API key** for speech recognition (Equatio), capable of causing high usage costs on the developer's subscription.
3. **AWS Access Keys** (Awesome Screen Recorder, Scrolling Screenshot Tool), potentially allowing unauthorized uploads or access to the developer's S3 buckets.
4. **Microsoft telemetry API Key** (Microsoft Editor), allowing pollution of usage analytics.
5. **Google API Key** used within the third-party **InboxSDK** library (Antidote Connector and 90+ others), leading to potential request duplication, quota exhaustion, or manipulation of Google services.
6. **Tenor GIF Search API Key** (Watch2Gether), risking rate limit exhaustion or account bans.
7. **FIAT RAMP API KEY** (Trust Wallet).
8. **Geolocation API key** (TravelArrow).
## Exploitation
- **Status:** Publicly disclosed, leading to high potential for exploitation. *Antidote Connector* has since patched the flaw related to InboxSDK.
- **Complexity:** Low. An attacker needs only download and inspect the extension package source code.
- **Attack Vector:** Network. Once the secret is extracted, an attacker can craft network requests exploiting the exposed credentials.
## Impact
The impact varies based on the exposed credential:
- **Confidentiality:** High (If AWS keys grant read access to sensitive data).
- **Integrity:** High (Ability to tamper with analytics data or upload malicious content to S3).
- **Availability:** Medium to High (Risk of service interruption due to quota exhaustion, service locking, or account bans from APIs). Financial loss due to unauthorized API usage is also a significant impact.
## Remediation
### Patches
* Developers must rotate all exposed keys immediately.
* Developers must remove hardcoded credentials from client-side code and move them to a secure backend server, using secure authentication flows (e.g., signed requests, OAuth).
* **Antidote Connector** resolved the specific InboxSDK issue in its latest version. Other vendors must issue updates addressing their specific exposed keys.
### Workarounds
* **For Users:** Immediately uninstall or disable the affected extensions until vendor patches are confirmed.
* **For Developers (Immediate):** If the key cannot be immediately rotated, implementing server-side checks or usage monitoring on the affected services is critical to detect anomalous access.
## Detection
- **Indicators of Compromise (IoCs):** Unexpected usage charges on Azure or AWS accounts tied to the extension's service; high volumes of unexpected requests to Google Analytics endpoints; unauthorized uploads/content appearing in developer S3 buckets.
- **Detection Methods and Tools:** Static Application Security Testing (SAST) tools configured to look for patterns matching known API key formats (e.g., AWS Access Keys, specific API URL structures) within static JavaScript files. Code review of extension source code is the primary detection method here.
## References
- Vendor advisories (Not directly provided in the excerpt for specific CVEs, implied by vendor patching).
- Relevant links (Defanged):
- hxxps://www.broadcom.com/support/security-center/protection-bulletin (For generic Symantec protection updates)
- hxxps://www.broadcom.com/products/cyber-security/endpoint/end-user (Symantec Endpoint Protection link)