Chrome Extensions Detection

Detection is done by probing chrome-extension://<id>/<web_accessible_resources> address.

Extension ID is taken from a Web Store URL:

1. https://chrome.google.com/webstore/detail/google-translate/aapbdbdomjkkjkaonfhkkikfgjllcleb

Inspect the extension sources to find the 'web_accessible_resources' key in the manifest.json file:

1. // Manifest V2
3. "web_accessible_resources": [
4. "options.html"
5. ]

1. // Manifest V3
3. "web_accessible_resources": [
4. {
5. "resources": [ "options.html" ],
6. "matches": [ "<all_urls>", "https://*/*", "*://*/*" ],
7. }
8. ]

If a script is able to fetch the resource, the extension is running:

1. fetch("chrome-extension://aapbdbdomjkkjkaonfhkkikfgjllcleb/options.html")
2. .then(() => {
3. console.log("Google Translate detected");
4. })
5. .catch(() => {
6. console.log("Google Translate not detected");
7. });

Some extensions have implemented protection against requesting web accessible resources from the web, by generating a secret token on each request. This protects against reading and including resources on the web page, but doesn't quite protect against detection.

It is possible to measure how long a request takes, and based on this, infer whether the extension is enabled or not. Fetching an enabled extension will, in most cases, take slightly longer than fetching a non-existent, uninstalled, or disabled one. We receive an error and cannot read the file, but the extra delay indicates that the resource exists.

1. chrome-extension://fakeiddddddddddddddddddddddddddd/web_accessible_resources/noop.txt
2. fake extension: we made 100 requests, average request time: 0.33ms
4. chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/web_accessible_resources/noop.txt
5. uBlock Origin : we made 100 requests, average request time: 0.48ms
7. 82/100 of requests to "cjpalhdlnbpafiamejdnhcphjbkeiagm" were slower, means we have uBlock enabled

This is an internal issue with Chrome, and this behavior cannot be fixed by add-on developers.

It is important to note that Brave is the only Chromium-based web browser that is not affected by this.

• Discovering Browser Extensions via Web Accessible Resources – Chalmers
• Protecting Browser Extensions from Probing and Revelation Attacks – NDSS
• Detection of uBlock Origin in Chrome via web_accessible_resource timing side channel #1572 – GitHub

• Chrome extension source viewer (CRX Viewer) – GitHub
• Manifest V2 - Web Accessible Resources – Chrome Developers
• Manifest V3 - Web Accessible Resources – Chrome Developers

• web_accessible_resources – MDN
• WebExtensions can be used as user fingerprint – Bugzilla