Some other “safe browser” implementations, such as Avast’s SafeZone and Bitdefender’s Safepay, did block the installation of malicious extensions. However, once it had created the profile, it kept using the same one, which meant that a malicious extension installed in the user’s regular browser profile could copy itself to the “safe browser” profile, Balazs said.īalazs said a third vendor, asked in a forum if its product detects or blocks Firefox keylogging extension Xenotix KeylogX, replied there was no need because “browser add-ons are subject to the same sandbox the browser runs through.” The vendor recommended that users remove any suspicious extensions themselves, he said.įor Balazs, the answer highlights the poor understanding some vendors have of this type of threat, because Firefox doesn’t have a sandbox and malicious browser extensions can be installed silently by malware without users ever knowing. However, it doesn’t protect against malicious browser extensions or local malware, Balazs said.Ī product from a different vendor came with a “safe browser” feature that involved creating a clean Firefox profile with no extensions installed. Not all of the tested products claim to protect against malicious extensions, but Balazs said he tested them because some users might believe they do.įor example, the NoScript security extension for Mozilla Firefox is designed to block plug-in content from executing without user authorization, and also blocks some Web-based attacks such as cross-site scripting or clickjacking. Many of these products either don’t detect and block malicious extensions at all, or their protection can be bypassed, sometimes very easily, he found. He performed tests against browser security extensions, sandboxing software, Internet security suites, anti-keylogging applications and financial fraud prevention programs recommended by some banks.

Earlier this year Balazs investigated how various security products protect users against malicious browser extensions and presented his findings at the OHM2013 security conference near Amsterdam in August.

Add avast browser extension