CODEWITHSUNDEEP
google-chromegoogle-chrome-extensionprivacy
aprevel
aprevel

Reputation: 41

What data is accessible to a disabled Chrome Extension?

I recently installed a nice Chrome Extension that is only useful from time to time. I would like to prevent it from gathering private data (history, email adresses, etc) when not in use.

Does the fact of disabling the extension stop all data sharing ?

Thanks a lot !

Upvotes: 0

Views: 755

Answers (1)

woxxom
woxxom

Reputation: 73616

  • When the browser starts with a disabled extension, the extension never runs.

  • When you disable an extension that was previously enabled, its scripts/pages are terminated immediately except for the content scripts. If the extension doesn't have content scripts in currently open tabs, then the extension is completely expunged at this point.

  • When you disable an extension that was previously enabled and it has content scripts in some tabs, these content scripts keep running, but they can't communicate with the extension's core, which has been completely terminated and disabled, so they are bound by the restrictions of the site i.e. they can't send data to a cross-origin URL, but they still can expose the data implicitly by loading a hidden image or CSS stylesheet with the data added as a URL query parameter in case the site doesn't have a strict CSP (Content-Security-Policy). Most sites don't have a strict CSP.

    You can reload all tabs or restart the browser to get rid of these leftovers.

Upvotes: 4

Related Questions