Can a website block a Chrome Extension?

dom, google-chrome, google-chrome-extension, javascript

Solution

For the short Answer to the question goto the 4th Edit:

You need to know the `extensionId` from the Extension you want to block, so that it works.

Here is a Testsite from the Prove of Concept Testsite

and here is the information behind the Solution: Intro to Chrome addons hacking: fingerprinting

Now that you know what Extensions are Running you can, redirect/block/...

I hope it helps.

Edit:

Tested with (Chrome Version 27.0.1453.94) on Windows XP

Edit 2:

This technique will only work if:

- You know the extensionid :)

- IMPORTANT! at least one Ressource(like the manifest.json, some image, script, ...) is set as "web_accessible_resources" (in the manifest) OR the extension still uses a manifest version 1 and has no "web_accessible_resources" set. (Ressource from chrome dev site Link)

Edit 3:

Case Extension: JSONView

You could detect the extension with this code(only example code):

<script src="chrome-extension://chklaanhfefbnpoihckbnefhakgolnmc/error.gif" onerror="console.info('Extension Not Found')" onload="console.info('Extension Found')"></script>
<!-- since the the file error.gif is allowed in the manifest "web_accessible_resources" (any other file mentioned there would also be fine) -->
<!-- the block code should come in the onload of the script tag -->
<!-- tested with Chrome 27+ WinXp -->

Some Context: The JSONView Extension has a version 2 Manifest:

...
"manifest_version": 2, 
"name": "JSONView",
...

so by default you cannot access the manifest file as mentioned in the "Prove of Concept" above.

BUT it uses the "web_accessible_resources" attribute in the Manifest, which allows websites to access files from the Extension.

...
"web_accessible_resources": [ "jsonview.css", "jsonview-core.css", "content_error.css", "options.png", "close_icon.gif", "error.gif" ]
...

So now you can call any of this files from your webpage.

example:

chrome-extension://chklaanhfefbnpoihckbnefhakgolnmc/error.gif
chrome-extension://chklaanhfefbnpoihckbnefhakgolnmc/jsonview.css
...

And with this url in an Image/Script/.. -Tag you can know if the extension is there, if the onload Event fires.

P.s.: i only tested this with Chrome Version 27.0.1453.94) on Windows XP, in other Versions it might not work. (see comment from T.J. Crowder)

P.P.s.: For More Details check the Chrome Developer Ressources. Here is the Link to the Extension on the Chrome Ressource Page "Finger printing" Stuff)

Edit 4:

I don't think it can be blocked per se, but if you can detect the extension as mentioned above you could:

- redirect away from your Page

- or Popup a message(every few seconds) saying, "disable the extension for this Site"

- or you could check the Extension code to see if you maybe could "break" or hinder its functionality.

- or you could use some Code like in the answer of BeardFist

Problem

Original source

Related problems

• Blocking Chrome Extensions from running on my site