1

I'm developing a Chrome extension that absolutely cannot be detected by a particular site.

Just checking, that in 2020, there is no method for a site to detect an extension if I am not injecting any DOM/JS/content into the page, and web_accessible_resources is not defined in manifest.json.

As far as I can tell Chrome is logging the 'Denying load of ...' error directly to DevTools console, bypassing the console.* api

Test code to see if I can hook the 'Denying load of..' error that fetch triggered - looks like you can't.

<script>
    const clog = console.log
    console.log = function(x) {
        clog('x: ',x)
    }
    const cerror = console.error
    console.error = function(x) {
        cerror('error: ',x)
    }
  window.fetch('chrome-extension://jifpbeccnghkjeaalbbjmodiffmgedin/options.js',{method: 'get'})
    .then(response => response.text()).then(body => console.log(body))
    .catch(err => console.log(err))

</script>

enter image description here

I think the policy code use of frame->addMessageToConsole bypasses the console.* API

https://chromium.googlesource.com/chromium/src/+/8747c1d912e10bbb8fe746ff6a06bb5a3d067efc/chrome/renderer/extensions/resource_request_policy.cc#89

if (!is_empty_origin && !is_own_resource &&
        !is_dev_tools && !transition_allowed && !is_error_page) {
      std::string message = base::StringPrintf(
          "Denying load of %s. Resources must be listed in the "
          "web_accessible_resources manifest key in order to be loaded by "
          "pages outside the extension.",
          resource_url.spec().c_str());
      frame->addMessageToConsole(
          blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError,
                                    blink::WebString::fromUTF8(message)));
      return false;
    }
Tim
  • 1,615
  • 1
  • 14
  • 17
  • 1
    This won't work because detecting the error would do you no good anyway - it's the same whether an extension is installed or not. – wOxxOm Oct 13 '20 at 05:05
  • 2
    See also [How to detect extension on a browser?](https://stackoverflow.com/q/40356596) – wOxxOm Oct 13 '20 at 05:12
  • @wOxxOm that does seem to be the definitive answer I'm after – Tim Oct 13 '20 at 05:22

0 Answers0