Skip to content

关于浏览器扩展和 IDE 插件漏洞的研究

浏览器扩展和 IDE 插件极大地拓展了功能，但它们也可能引入从安全漏洞到性能和兼容性问题等各种错误。下方我们以结构化表格的形式记录了20 个真实案例，随后对其中的常见模式、影响以及统计数据进行分析。

案例研究表

Bug ID / CVE Affected Software Bug Type Root Cause Impact on Host Resolution
CVE-2019-16371 LastPass Password Manager extension (Chrome/Opera) (NVD - CVE-2019-16371) Security (Info Leak) Logic flaw in extension popup handling (cached credentials reused; failure to validate context) (NVD - CVE-2019-16371) Exposed credentials for the previously visited site to malicious websites (password leak) (LastPass patched a security vulnerability from the extensions generated on pop-up windows) Patched in LastPass v4.33.0 (fixed popup logic) (LastPass patched a security vulnerability from the extensions generated on pop-up windows)
CVE-2018-6654 Grammarly extension (Chrome, Firefox) (NVD - CVE-2018-6654) Security (Auth Token Leak) Insufficient origin validation – extension exposed user authentication tokens to any website via API calls (NVD - CVE-2018-6654) Allowed any website to hijack Grammarly auth tokens (could access user documents) (Critical Flaw in Grammarly Spell Checker Could Let Attackers Steal ...) Fixed Feb 2, 2018 update (restricted token access) (NVD - CVE-2018-6654)
CVE-2019-12592 Evernote Web Clipper extension (Chrome) (Evernote XSS extension flaw puts personal data of millions at risk | The Daily Swig) Security (Universal XSS) Coding logic error enabling Same-Origin Policy bypass – extension scripts in iframes weren’t properly isolated (Evernote XSS extension flaw puts personal data of millions at risk | The Daily Swig) (Evernote XSS extension flaw puts personal data of millions at risk | The Daily Swig) Malicious sites could execute script in context of other sites (account data theft from 3rd-party sites) (Evernote XSS extension flaw puts personal data of millions at risk | The Daily Swig) Patched in v7.11.1 within 4 days of report (Evernote XSS extension flaw puts personal data of millions at risk | The Daily Swig) (Evernote XSS extension flaw puts personal data of millions at risk | The Daily Swig)
CVE-2017-6753 Cisco WebEx Meeting extension (Chrome, Firefox on Windows) (NVD - CVE-2017-6753) Security (Remote Code Exec) Design defect – extension exposed a high-privilege native function without proper domain restriction (NVD - CVE-2017-6753) Visiting a malicious page could execute arbitrary code on the system with browser privileges (NVD - CVE-2017-6753) Updated to v1.0.12 with restricted access (Cisco patched the flaw) (NVD - CVE-2017-6753)
(No CVE) Adblock Plus (and similar adblockers) v3.2 filter feature (Adblock Plus filter feature runs risk of malicious code exploit | The Daily Swig) (Adblock Plus filter feature runs risk of malicious code exploit | The Daily Swig) Security (Code Injection) Over-permissive filter $rewrite option – allowed filter list maintainer to inject arbitrary JS into webpages under certain conditions (Adblock Plus filter feature runs risk of malicious code exploit | The Daily Swig) Potential for malicious filters to run code on any site a user visits (e.g. steal logins, alter content) (Adblock Plus filter feature runs risk of malicious code exploit | The Daily Swig) (Adblock Plus filter feature runs risk of malicious code exploit | The Daily Swig) Removed the $rewrite feature entirely in next update (April 2019) (Potential vulnerability through the URL rewrite filter option | Adblock Plus and (a little) more) (Potential vulnerability through the URL rewrite filter option | Adblock Plus and (a little) more)
CVE-2020-1171 VS Code – Python Extension (Microsoft) (NVD - cve-2020-1171) Security (Remote Code Exec) Unsafe loading of project configuration files on open – extension executed code from workspace config without validation (NVD - cve-2020-1171) Opening a malicious project could execute arbitrary code on the developer’s machine (high-severity RCE) (NVD - cve-2020-1171) Patched by Microsoft in extension update (May 2020) (NVD - cve-2020-1171) (hardened config loading)
CVE-2020-1192 VS Code – Python Extension (Jupyter support) (NVD - cve-2020-1192) Security (Remote Code Exec) Trusting Jupyter notebook workspace settings – a .ipynb file could contain hostile settings that get loaded/executed (NVD - cve-2020-1192) Opening a malicious notebook could run code on host (developer privileges) (NVD - cve-2020-1192) (NVD - cve-2020-1192) Patched by Microsoft (May 2020) – extension now sanitizes or prompts on notebook config (NVD - cve-2020-1192)
CVE-2023-46944 VS Code – GitLens extension <14.0.0 (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Security (Arbitrary Code Exec) Insecure use of local Git configs – extension executed Git commands in workspace without sanitizing repository settings (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) (malicious repo config could inject commands) Opening a malicious Git repository in VS Code could execute OS commands (bypassing VS Code’s Workspace Trust) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Fixed in GitLens v14.0.0 – updated to ignore or safely handle untrusted repo configs (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar)
(pending CVE) VS Code – GitLens extension (Hover Markdown) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Security (Arbitrary Code Exec) Improper Markdown handling – extension marked untrusted commit data as isTrusted=true and failed to sanitize CR/LF, allowing injection of command: links in hover text (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Viewing a malicious commit message (hover tooltip) could inject VS Code commands, leading to code execution when clicked (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Fixed in GitLens v14.0.0 – removed unsafe Markdown trust and filtered input (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar)
CVE-2023-36867 VS Code – GitHub Pull Requests extension <0.66.2 (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Security (Remote Code Exec) Markdown injection in issue/PR view – extension rendered untrusted content with isTrusted, allowing attacker markdown to include executable command: links (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Viewing a poisoned GitHub issue or PR in VS Code could trigger local code execution (attacker could run VS Code commands remotely) (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar) Patched in v0.66.2 (July 2023) – update sanitizes markdown and respects workspace trust (Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3) | Sonar)
CVE-2024-37051 JetBrains IDEs – GitHub Integration Plugin (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog) (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog) Security (Token Leak) Inadequate content sanitization – malicious GitHub Pull Request content could embed references that caused the IDE’s GitHub plugin to send OAuth tokens to an attacker’s server (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog) (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog) Exposure of GitHub access token to third-party (could lead to compromise of code repositories) (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog) JetBrains patched plugin (June 2024) and removed vulnerable versions (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog) (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog); users had to update and revoke tokens (Updates for security issue affecting IntelliJ-based IDEs 2023.1+ and JetBrains GitHub Plugin | The Security Blog)
CVE-2024-24941 JetBrains IntelliJ IDEA – Space plugin <2023.3.3 (NVD - Results) Security (Sensitive Data Exposure) Over-broad permissions – Space (JetBrains) plugin sent an auth token to an unintended URL due to improper access control (NVD - Results) Potential leak of Space authentication token (could allow unauthorized access to Space services) (NVD - Results) Fixed in IntelliJ 2023.3.3 – Space plugin updated to restrict token usage (NVD - Results)
(No ID) IntelliJ IDEA – Eclipse Interoperability Plugin (java - IntelliJ Idea Community Edition using excessive memory - Stack Overflow) Performance (Memory Leak) Resource mismanagement – plugin retained large objects when using the “Open Project” dialog (did not free memory on project switch) (java - IntelliJ Idea Community Edition using excessive memory - Stack Overflow) Extreme memory bloat (IDE RAM usage grew >2.7 GB, causing slowness/hangs) (java - IntelliJ Idea Community Edition using excessive memory - Stack Overflow) (java - IntelliJ Idea Community Edition using excessive memory - Stack Overflow) User workaround: disable/remove plugin (java - IntelliJ Idea Community Edition using excessive memory - Stack Overflow) (JetBrains later fixed the leak in an update per user reports)
(No ID) IntelliJ IDEA – SonarLint Plugin 10.11 (Memory leak org.sonarlint.idea (10.11.0.79648) - IntelliJ Platform - Sonar Community) (Memory leak org.sonarlint.idea (10.11.0.79648) - IntelliJ Platform - Sonar Community) Performance (Memory Leak) Excessive indexing – plugin indexed generated/ignored files due to a logic oversight, accumulating unwanted data in memory (Memory leak org.sonarlint.idea (10.11.0.79648) - IntelliJ Platform - Sonar Community) Gradual memory exhaustion during coding sessions (IDE would slow down or crash if memory exceeded) (Memory leak org.sonarlint.idea (10.11.0.79648) - IntelliJ Platform - Sonar Community) (Memory leak org.sonarlint.idea (10.11.0.79648) - IntelliJ Platform - Sonar Community) Awaiting patch (identified by devs in Oct 2024) – workaround to exclude problematic folders (Memory leak org.sonarlint.idea (10.11.0.79648) - IntelliJ Platform - Sonar Community)
(No ID) Eclipse IDE – PMD static analysis plugin 4.0 (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub) (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub) Logic Error (Race Condition) Timing issue on startup – if projects had PMD with external rulesets, the plugin initialization could deadlock or crash Eclipse (likely a threading/race bug) (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub) (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub) Eclipse would consistently crash or freeze during launch when certain PMD settings were enabled (required multiple restarts) (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub) (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub) Fixed in PMD plugin 4.26.0 – reworked startup sequence (users could disable PMD or close projects as a workaround) (Eclipse nearly-consistently crashes on startup when workspace contains PMD enabled projects · Issue #148 · pmd/pmd-eclipse-plugin · GitHub)
(No ID) Chrome – Web Scrobbler Extension v2.40 (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub) (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub) Performance (Infinite Loop) Logic bug in service worker – an icon-loading function repeatedly retried due to a programming error (infinite fetch loop in extensions::setIcon) (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub) 100% CPU usage continuously by the extension’s background process, causing browser slowdown and high power consumption (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub) (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub) Fixed in subsequent release – developers resolved the loop condition (users could disable extension to stop the CPU drain) (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub) (High CPU usage at idle and continuously looping fetch for extensions::setIcon · Issue #3789 · web-scrobbler/web-scrobbler · GitHub)
(No ID) Android Studio 4.1 – Third-party Plugin (e.g. old Android Drawable Importer) (Android Studio 4.1 Plugin Error: Plugin * is incompatible (supported only in IntelliJ IDEA) - Stack Overflow) Compatibility (Unsupported Plugin API) Outdated plugin not updated for new IDE – API changes made the plugin incompatible (manifest flagged “IntelliJ only”) (Android Studio 4.1 Plugin Error: Plugin * is incompatible (supported only in IntelliJ IDEA) - Stack Overflow) Plugin failed to load, causing error pop-ups at IDE startup; functionality provided by that plugin was unavailable (Android Studio 4.1 Plugin Error: Plugin * is incompatible (supported only in IntelliJ IDEA) - Stack Overflow) (Android Studio 4.1 Plugin Error: Plugin * is incompatible (supported only in IntelliJ IDEA) - Stack Overflow) Remove or update plugin – users had to manually delete it since the IDE disabled listing it (Android Studio 4.1 Plugin Error: Plugin * is incompatible (supported only in IntelliJ IDEA) - Stack Overflow) (plugin developer later released an update to restore compatibility)
CVE-2024-0740 Eclipse IDE – Terminal & RSE plugin <=4.5.400 (NVD - CVE-2024-0740) Security (Remote Code Exec) Missing authentication on a service – the Remote System Explorer exposed a network-accessible functionality without auth, allowing arbitrary commands/actions (NVD - CVE-2024-0740) Critical RCE: An attacker could remotely execute code on the developer’s machine without user interaction (network attack vector) (NVD - CVE-2024-0740) Fixed in Eclipse 2024-03 release – RSE plugin patched to require authentication or disabled vulnerable service (NVD - CVE-2024-0740) (NVD - CVE-2024-0740)

表格：浏览器扩展和 IDE 插件中的真实漏洞案例，涵盖类型、原因、影响与解决方案。 每个案例都对应了公开报告、CVE 或开发者讨论等来源。

模式与影响分析

常见模式与根本原因

从以上多样的案例可以看出，扩展和插件漏洞常有下列明显模式：

总之，逻辑错误（尤其牵涉信任边界与输入处理）是严重漏洞最常见的根源，特别在安全层面。内存和性能问题往往出自资源管理不当（循环、泄漏、过度索引），而兼容性问题则缘于插件没遵循稳定的 API 开发。

对稳定性、可维护性和安全性的影响

扩展与插件中的错误，会显著影响宿主应用及用户：

统计观察：Bug 类型的频率与严重性

基于收集到的（20+）示例，我们可以总结一些统计洞察：

  • 安全 vs. 一般 Bug： 大约 60% 的案例是安全漏洞，40% 属于一般错误（逻辑、性能、兼容性）。这是因为安全漏洞往往被公开上报（CVE 标记）。在实际环境中，一般错误（如小逻辑缺陷、UI 问题、速度变慢）可能更多——大型扩展通常在其问题跟踪库里就有大量报告。然而，安全漏洞虽数量相对少，但影响最严重，往往获得更多关注。非安全 Bug 常见但影响通常较轻（除非导致崩溃或数据丢失，这种情况就更严重）。

  • 最常见的漏洞类型： 若把安全与非安全合并，逻辑错误发生最频繁（包括流程或条件判断错误，如未调用某函数、错误条件导致泄露、无限循环等）。在本次样本中，逻辑/设计缺陷造成了 100% 的安全问题（并无底层内存破坏，因为浏览器/IDE 插件大多是托管语言编写）。同样，它们也造成了 Web Scrobbler 无限循环和 PMD 启动竞态等问题。性能问题（如内存泄漏）在插件开发中也相当普遍——我们就看到多个泄漏案例。兼容性问题在大版本更新时很常见，但通常是暂时性的（插件可能很快更新修复）。

  • 最严重的漏洞类型： 按严重性而言，RCE（远程代码执行）和凭据泄露最危急。在我们的清单里，约有 8/20 个案例在特定条件下可能导致 RCE（占 40%，均为安全问题），这是因为能完全攻陷系统或帐号。其后是通用 XSS/数据注入（如 Evernote、Adblock Plus），可导致会话劫持与用户冒充。一般错误中，会造成应用崩溃或卡死的影响在稳定性层面上可算高严重度（尽管不涉及安全）。例如持续数小时后必崩溃的内存泄漏对可靠性非常严重。兼容性问题排在严重度较低的位置（只会让插件失效，一般不损坏数据），轻微逻辑失误只影响某功能而不产生更广影响，则严重度也较低。

  • 按根本原因分布： 值得注意的是，90%+ 的安全漏洞源于扩展处理数据或权限时的逻辑/设计缺陷，而并非内存破坏。这与技术栈有关：浏览器/IDE 扩展多用 JS 等高级语言，内存安全问题少见，逻辑错误占主导。相对而言，内存泄漏与性能故障多因内存管理或事件循环处理不当。本次列举的无限循环有 2 例、内存泄漏有 2 例，说明这是重复出现的痛点。更广泛的研究（超出本样本）也会发现内存泄漏和 UI 卡死在大型 IDE 插件里是高频报障问题。

  • 跨环境问题： 某些问题类型在浏览器扩展和 IDE 插件中都可见。比如无限循环或高 CPU 在 Chrome content script 与 VS Code extension 进程里都可能出现。凭据泄露也同时发生在 web 场景（Grammarly 网络令牌）与 IDE 场景（JetBrains 访问令牌）。这表明只要扩展/插件处理凭据或敏感数据，都需极其谨慎，不分平台。另外，通过内容（Markdown/HTML）进行攻击在 IDE 插件里变得日益突出（由于支持 markdown 预览、在工具提示中渲染 diff 等），与传统浏览器层面的 XSS 原理近似（像在 IDE 中利用恶意 README 或 commit message）。

  • 定量简述： 此次案例中，安全漏洞一般 CVSS 分数较高（很多 8.0+ 的 HIGH 或 9.8 CRITICAL 级别（NVD - CVE-2024-0740））。而一般 Bug 无此评分，但我们可定性评估：约 8 个普通问题中有 5 个 导致严重性能下降或崩溃（可视为对用户“高影响”）。兼容性问题（其中 2 个）影响中等（功能暂失）。所以总体看，~25% 的全部案例是 RCE 级别的严重漏洞，另有 30-35% 属于高严重度的信息泄露或崩溃，其余为中低严重度。

  • 生态趋势： 统计上，浏览器扩展环境常见权限滥用与 XSS。2018 年有研究指出大部分 Chrome 扩展漏洞来自 DOM 操控与消息传递等问题（本文未直接引，但业界熟知）。IDE 插件方面，近期 SonarSource 与 Trail of Bits 的报告揭示工作区攻击向量不断增多——如恶意项目文件利用信任，这在 VS Code 案例中得到印证。性能上，现代 IDE 通常会警告“慢插件”，来自 JetBrains 的数据也显示复杂语言支持（Python、Java）插件 often 导致性能抱怨，这与我们看到的内存泄漏案例相符。

综上所述，安全漏洞虽较少但最具危害。它们往往源于常见模式（验证不当、权限过宽等），可用更审慎的设计加以缓解（如内容安全策略、请求用户授权、遵循“受信任的工作区”设定）。而通用 Bug（如内存泄漏、性能问题）更普遍，强调了在真实负载下测试插件/扩展以及遵循资源管理最佳实践的重要性。兼容性问题则提示我们，扩展/插件开发者必须跟进宿主应用的演进，否则会出现功能断裂。

最终看来，扩展/插件模型带来巨大灵活性，但也扩展了攻击面并增加了出错可能。通过识别这些模式及其影响，用户和开发者都可更好地理解风险并着力预防——例如，用户只安装可信且必要的扩展，开发者则应对与外部内容或系统资源交互的功能进行严格审计。

Share on Share on