Chrome Extension Detection

Chrome extensions can be detected by attempting to access their internal resources (such as images, scripts, or HTML files) from a web page. If the resource is accessible, it indicates that the extension is installed and active in the user's browser (extensions that are disabled cannot be detected).

To see if a user has Google Translate active, an attacker could try to request it using the Fetch API:

1. // The URL contains the extension’s ID and one of its internal resources:
2. fetch("chrome-extension://aapbdbdomjkkjkaonfhkkikfgjllcleb/popup_css_compiled.css")
3. .then(() => {
4. console.log("Google Translate detected");
5. })
6. .catch(() => {
7. console.log("Google Translate not detected");
8. });

However, not every internal extension file is accessible from the web. Only those declared under the "web_accessible_resources" property in the extension’s manifest file can be requested this way.

Additionally, in the latest Google Chrome versions, the "use_dynamic_url" element has started working, protecting extensions from fingerprint by generating a new ID for each session. That means the URL is regenerated when the browser restarts or the extension reloads.

Below is an example snippet from the Google Translate manifest.json:

1. "web_accessible_resources": [{
2. "resources": ["popup_css_compiled.css"],
3. "matches": ["<all_urls>"],
4. // "use_dynamic_url": true
5. }],

If the last line with "use_dynamic_url" had been enabled, the resource would not have been fetched. If all resources use dynamic URLs, the extension cannot be detected. Unfortunately, today very few extensions that use web-accessible resources also enable this feature.

Some extensions have implemented protection against requesting web-accessible resources from the web, by generating a secret token on each request. This protects against reading and including resources on the web page, but doesn't quite protect against detection.

It is possible to measure how long a request takes, and based on this, infer whether the extension is enabled or not. Fetching an enabled extension will, in most cases, take slightly longer than fetching a non-existent, uninstalled, or disabled one. We receive an error and cannot read the file, but the extra delay indicates that the resource exists.

1. chrome-extension://fakeiddddddddddddddddddddddddddd/web_accessible_resources/noop.txt
2. fake extension: we made 100 requests, average request time: 0.33ms
4. chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/web_accessible_resources/noop.txt
5. uBlock Origin : we made 100 requests, average request time: 0.48ms
7. 82/100 of requests to "cjpalhdlnbpafiamejdnhcphjbkeiagm" were slower, means we have uBlock enabled

This is an internal issue with Chrome, and this behavior cannot be fixed by add-on developers.

It is important to note that Brave is the only Chromium-based web browser that is not affected by this.

• Manifest V3 - Web Accessible Resources – Chrome Developers
• Manifest V2 - Web Accessible Resources – Chrome Developers
• Chrome extension source viewer (CRX Viewer) – GitHub

• Discovering Browser Extensions via Web Accessible Resources – Chalmers
• Protecting Browser Extensions from Probing and Revelation Attacks – NDSS
• Detection of uBlock Origin in Chrome via web_accessible_resource timing side channel #1572 – GitHub

• web_accessible_resources – MDN
• WebExtensions can be used as user fingerprint – Bugzilla