# Malicious extensions circumvent Google's remote code ban

DevFeed: [Malicious extensions circumvent Google's remote code ban](<https://devfeed.tech/articles/malicious-extensions-circumvent-google-s-remote-code-ban-36624.md>)

Original publisher: [Read original article](<https://palant.info/2025/01/20/malicious-extensions-circumvent-googles-remote-code-ban/>)

Author: Wladimir Palant

Published: 2025-01-20T13:32:07Z

Content type: opinion

Language: en

Sources: [Almost Secure](<https://devfeed.tech/sources/almost-secure.md>)

Topics: [Extension](<https://devfeed.tech/topics/extension.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Security](<https://devfeed.tech/topics/security.md>), [browser](<https://devfeed.tech/topics/browser.md>), [API](<https://devfeed.tech/topics/api.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

The article examines how malicious Chrome extensions circumvent Google's Manifest V3 restrictions on remote code. It discusses techniques including bundled JavaScript interpreters, injected HTML, declarativeNetRequest abuse, new-tab opening, user spying, and anti-debugging protection, with detailed attention to extensions associated with Phoenix Invicta.

## Source excerpt

As noted last week I consider it highly problematic that Google for a long time allowed extensions to run code they downloaded from some web server, an approach that Mozilla prohibited long before Google even introduced extensions to their browser. For years this has been an easy way for malicious extensions to hide their functionality. When Google finally changed their mind, it wasn't in form of a policy but rather a technical change introduced with Manifest V3. As with most things about Manifest V3, these changes are meant for well-behaving extensions where they in fact improve security. As readers of this blog probably know, those who want to find loopholes will find them: I've already written about the Honey extension bundling its own JavaScript interpreter and malicious extensions essentially creating their own programming language. This article looks into more approaches I found used by malicious extensions in Chrome Web Store. And maybe Google will decide to prohibit remote code as a policy after all. Update (2025-01-20): Added two extensions to the bonus section. Also indicated in the tables which extensions are currently featured in Chrome Web Store. Update (2025-01-21): Got a sample of the malicious configurations for Phoenix Invicta extensions. Added a section describing it and removed "But what do these configurations actually do" section. Also added a bunch more domains to the IOCs section. Update (2025-01-28): Corrected the "Netflix Party" section, Flipshope extension isn't malicious after all. Also removed the attribution subsection here. Contents Summary of the findings Phoenix Invicta Injecting HTML code into web pages Abusing declarativeNetRequest API Opening new tabs The scheme summarized The payload Who is behind these extensions? The affected extensions Netflix Party Spying on the users The bogus rule processing The affected extensions Sweet VPN Anti-debugging protection Guessing further functionality The affected extensions Bonus section: more