CODEWITHSUNDEEP
securitygoogle-chrome-extension
AyKarsi
AyKarsi

Reputation: 9685

Can a chrome extension read data from the local storage?

If a chrome-extension requests the permission "Read and modify all your data on all websites you visit", can it then read data from the local storage of one of these visited sites?

I'm asking this because I know of some websites which store authentication tokens in the local storage. If the extension can access the token, it would be frightfully easy to harvest access tokens...

Upvotes: 1

Views: 390

Answers (1)

woxxom
woxxom

Reputation: 73806

The answer is Yes. Content script injected by an extension has full access to localStorage for the site.

Upvotes: 4

Related Questions