Can web applications be secured against browser extensions?

Question

It seems there are a vast number of browser extensions that exhibit malicious behavior. Additionally, even valid extensions could suffer from security vulnerabilities that make them behave maliciously.

One way to avoid this problem is to package your web application with a platform like NWJS, Electron, or similar. This has the advantage of removing the extension ecosystem, but also suffers from a number of drawbacks (installation process, more resource consumption, increased labor, and more).

Some have argued that " In the end it's the user's responsibility, not the website's fault that the user is compromised ". While that makes a good point, those of us responsible for software that manages sensitive data still have a duty to protect.

When writing a web application that will access sensitive data, is there anything that can be done to secure against browser extensions?

---

Edit: Any creative solutions to this problem would be great. Alternatively, a confirmed negative would also be welcome. Some trails of thought that extend from this question:

• Can the window object be protected or somehow made private?
• Are there any restrictions to an extension's JavaScript that loads before the page that could be used to the web application's advantage?
• Can a companion extension detect other extensions and then communicate to the web application that it is unsafe to run? Or at least notify the user of the potential for abuse?
• Are extension background scripts also injected into iframes and child windows create by calling window.open? Perhaps the web application would replace the window object with different safe copy of a window object.
• Might there be some clever way to detect if third-party code has been run on the page? A sort of "hash" of the JavaScript environment?

Answer 1

There's a (primitive) solution to detect user extensions installed on the browser, from there I guess you can deny the access to your web application until the user uninstalls these extensions. It consists in a small database of assets (icons), if the javascript can find these assets, it means the extension is installed.

CONS: You can't detect if the extensions are running, therefore if the user disables them that won't be detected and you will still get a positive.

The code is in this link:

Can a Website detect what browser extensions are being used?

Post with users feeding this database with more assets:

https://blog.jeremiahgrossman.com/2006/08/i-know-what-youve-got-firefox.html