Reported by The Next Web, a developer created a plugin for the Google Chrome browser that can watch users’ login information and send that information to him via email. The programmer who created the attack, Andreas Grech, coded the plugin in jQuery. Grech is only demonstrating the attack and isn’t using it maliciously but it is more than a proof of concept, it’s real and in the wild. He details the attack on his blog and reveals the code behind the exploit. He says that he has tested it and it has been successful against major sites like Facebook, Gmail, and Twitter.

Grech’s explanation from his blog of how the attack works:

The Google Chrome browser allows the installation of third-party extensions that are used to extend the browser to add new features. The extensions are written in JavaScript and HTML and allow manipulation of the DOM, amongst other features.

By allowing access to the DOM, an attacker can thus read form fields…including username and password fields. This is what sparked my idea of creating this PoC.

The extension I present here is very simple. Whenever a user submits a form, it tries to capture the username and password fields, sends me an email via an Ajax call to a script with these login details along with the url and then proceeds to submit the form normally as to avoid detection.

Grech also mentions that while he used this attack to steal login information, it could also be used to steal cookies or hijack browsing sessions. This attack is a good reminder that IE isn’t the only vulnerable browser around and to be cautious when installing 3rd-party extensions. Until Google patches this hole, right now it is a good idea to be extra careful about checking whether a plugin comes from a reputable source.