Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen

Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen

Speakers: Marek Tóth

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=Gu4IoDXNqoU

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Marek%20Toth%20-%20Browser%20Extension%20Clickjacking%20One%20Click%20and%20Your%20Credit%20Card%20Is%20Stolen.pdf

Overview

Browser extensions occupy a uniquely dangerous position in the web security ecosystem. They run with elevated privileges, can observe and modify web content across every tab, and are trusted by default once installed. In this DEF CON 33 talk, Marek Tóth exposes a novel class of attack against browser extensions themselves: clickjacking techniques that can be used to silently steal payment card data, credentials, and other sensitive information with nothing more than a single deceptive click from the victim.

The attack is particularly insidious because it subverts the same extensions users rely on for security — password managers, shopping helpers, and autofill utilities — turning their privileged access into an attacker's advantage. The research demonstrates that even well-known, widely distributed extensions are vulnerable to this class of manipulation.

Background

▶ Watch: Introduction: Browser extension clickjacking attack overview and threat model (1:48)

Clickjacking (UI redressing) is a well-understood attack class at the web application layer: an attacker overlays an invisible or opaque iframe over a legitimate button, tricking the user into clicking something they cannot see. Browser vendors and web developers have deployed a range of defenses — X-Frame-Options, Content-Security-Policy: frame-ancestors, and SameSite cookie flags — that have significantly reduced the prevalence of classic clickjacking against websites.

However, browser extensions introduce a distinct attack surface that these mitigations do not cover. Extensions expose HTML-based popup UIs, sidebar panels, options pages, and content scripts injected into web pages. These surfaces can interact with each other and with web content in complex ways that were not designed with clickjacking as a primary threat model. While some prior work has addressed extension-to-extension attacks and content script injection abuse, the specific combination of clickjacking techniques targeting extension UI components to exfiltrate payment data had not received focused treatment before this research.

The extension ecosystem is enormous: the Chrome Web Store alone hosts over 130,000 extensions. Many of the most popular ones — particularly autofill and payment helpers — process highly sensitive financial data. A successful attack against these extensions bypasses the browser's site isolation model entirely, because the extension's privileged context is what is being exploited, not a cross-origin web page.

Key Findings

▶ Watch: - Extension popup UIs are clickjackable. (11:15)

• Extension popup UIs are clickjackable. Many browser extensions render their popup or sidebar UI without adequate protections against being embedded or overlaid by attacker-controlled content, allowing a malicious web page to position invisible clickable elements over extension UI controls.

• Single-click payment exfiltration is achievable. By carefully timing and positioning the clickjacking overlay, an attacker can cause a victim's one-click interaction — for example, clicking what appears to be a "Continue" button on a shopping site — to instead trigger an autofill or payment submission action in an underlying extension, sending card data to the attacker.

• Password manager extensions are similarly exposed. The same attack surface that exposes payment data also applies to credential autofill actions, meaning login credentials can be harvested with the same single-click technique.

• Browser vendor mitigations are insufficient. Standard CSP frame-ancestors and X-Frame-Options headers govern web content, not the extension sandbox. Extension popup windows are not subject to these defenses in the same way.

• Popular extensions fail basic UI isolation checks. The research identified that a significant number of high-install-count extensions do not implement the frame-busting or interaction-verification logic necessary to prevent this class of attack.

Technical Deep Dive

▶ Watch: - Browser vendor mitigations are insufficient. (18:00)

The attack chain has several components. First, the attacker controls a web page that the victim visits — this could be a phishing page, a malicious advertisement, or a compromised legitimate site. The page uses JavaScript to detect whether a target extension is installed (a well-documented fingerprinting technique based on probing chrome-extension:// resource URLs or observing DOM mutations introduced by content scripts).

Once the target extension is confirmed present, the attack page constructs an overlay. The extension's popup UI — which can be triggered or positioned programmatically in some configurations — is layered beneath a convincing decoy UI rendered by the attacker's page. CSS opacity: 0 or pointer-events manipulation ensures the extension UI is clickable but invisible to the user.

The critical insight is that browser extensions often use the chrome.tabs or webRequest APIs to autofill forms or submit payment data, and these actions are triggered by user interaction events within the extension's UI. If an attacker can produce a synthetic or misdirected click event that lands on the extension's "Autofill" or "Pay" button, the extension will faithfully execute that action — sending card details or credentials to whatever form fields or network endpoints are targeted.

Tóth's research maps the attack across different extension architectures: Manifest V2 extensions using background pages with direct DOM access, and Manifest V3 extensions with service workers. While Google's MV3 transition was partly motivated by security improvements, the clickjacking surface in popup and content script UI is not materially reduced by the manifest version change.

For payment card theft specifically, the attack flow is:

1. Victim visits attacker page while a target payment extension is installed.
2. Extension is fingerprinted; attack UI overlay is prepared.
3. Victim performs an ostensibly legitimate action (e.g., "Confirm Order").
4. Click lands on extension's payment autofill or submit control.
5. Extension populates and submits payment card data to attacker-controlled form or endpoint.
6. Card data is exfiltrated; victim sees no anomaly.

Demo / Proof of Concept

▶ Watch: Once the target extension is confirmed present, the attack page constructs an... (24:45)

The talk includes live demonstrations against real-world extensions — including extensions with millions of active users — that exhibit this vulnerability. Tóth shows the complete attack chain from a user visiting a malicious page to payment card data appearing in the attacker's server logs, triggered by a single deceptive click.

The proof-of-concept code demonstrates both the fingerprinting phase (reliably detecting whether a vulnerable extension is installed without requiring any permissions) and the overlay construction phase (positioning the invisible clickable layer with pixel accuracy using CSS transforms and getBoundingClientRect measurements).

A secondary demo shows the same technique applied to a popular password manager extension, triggering an autofill of username and password fields on an attacker-controlled form, effectively harvesting credentials in a single user interaction.

Defensive Implications

▶ Watch: For payment card theft specifically, the attack flow is: 1. (31:29)

For extension developers:

• Extension popup UIs should not be embeddable or overlayable by arbitrary web content. Implementing strict Content Security Policy headers in extension HTML pages and using window.top !== window.self guards can reduce exposure.
• Any action that results in sensitive data being submitted or autofilled should require explicit, verifiable user intent — ideally with a confirmation dialog rendered inside the extension's trusted context, not in a web page frame.
• Extensions should validate that UI interactions originate from expected contexts and not from synthesized or redirected events.
• Consider adopting pointerEvents and focus management guards that detect overlay conditions before executing privileged actions.

For browser vendors:

• Browser engines could implement restrictions on how extension popups can be positioned and interacted with relative to web content frames.
• Improved extension permission transparency and interaction auditing in developer tools would help identify these attack patterns during extension review.

For users:

• Be cautious about which extensions have access to payment and autofill data. Periodically audit installed extensions and remove any that are no longer actively maintained.
• Use extensions from verified publishers and keep them updated; vendors who are aware of this research may push patches.
• Consider using browser-native payment and password management features where possible, as these are more tightly integrated with the browser's security model.

Key Takeaways

1. The clickjacking threat model extends to browser extension UIs, not just web pages — and existing mitigations do not adequately address this surface.
2. A single deceptive click is sufficient to exfiltrate full payment card data when a vulnerable autofill or payment extension is installed.
3. Manifest V3 does not resolve this class of vulnerability; the attack surface is in the UI interaction model, not the extension background execution model.
4. Extension developers need to treat their popup and content script UIs as attack surfaces subject to UI redressing and implement explicit defenses.
5. The widespread deployment of payment and credential extensions makes this a high-impact, broadly exploitable vulnerability class requiring prompt attention from the extension ecosystem.

About the Speaker(s)

▶ Watch: A secondary demo shows the same technique applied to a popular password manag... (39:09)

Marek Tóth is a security researcher specializing in browser security and web application vulnerabilities. His work at DEF CON 33 represents a focused investigation into the underexplored intersection of browser extension architecture and classical UI redressing attack techniques, demonstrating that extensions trusted by hundreds of millions of users can be turned into instruments for payment fraud through carefully crafted clickjacking attacks.