Affiliations: [a] School of Computer Science and Engineering, Vellore Institute of Technology, Chennai, Tamilnadu, India
| [b]
Schools of Information Technology and Engineering, Vellore Institute of Technology, Vellore, Tamilnadu, India
| [c]
Department of Computer Science and Engineering, Sona College of Technology, Salem, Tamilnadu, India
Correspondence:
[*]
Corresponding author. M. Marimuthu, School of Computer Science and Engineering, Vellore Institute of Technology, Chennai, Tamilnadu, India. E-mail: [email protected]..
Abstract: Web browsers have become an integral part of our daily lives, granting us access to vast information and services. However, this convenience significantly risks personal information and data security. One common source of this risk is browser extensions, which users often employ to add new features to their browsers. Unfortunately, these extensions can also pose a security threat, as malicious ones may access and steal sensitive information such as passwords, credit card details, and personal data. The vulnerability of web browsers to malicious extensions is a significant challenge that effectively tackles through robust defence mechanisms. To address this concern, Secure Vault – API is proposed and designed to safeguard confidential web page content from malicious extensions. The Web Crypto API provides cryptographic functions that protect data during transmission and storage. The Secure Vault encompasses a Sentinel extension responsible for parsing the web page’s Document Object Model (DOM) content and querying for all “vault” elements. The extension then verifies that the DOM content has not been tampered with by any malicious extension by calculating the SHA512 hash value of the concatenated vault elements as a string, with no whitespace between them. With its encryption, hashing, and isolation techniques, the Secure Vault effectively protects confidential web page content from malicious extensions. It provides a secure environment for storing and processing sensitive data, reducing the risk of data breaches caused by malicious extensions. The proposed approach offers significant advantages over existing strategies in terms of protecting confidential web page content from malicious extensions. This not only improves the efficiency and effectiveness of the browser extensions but also ensures compatibility, interoperability and performance across different web browsers with respect to the load time of HTML elements. Users can browse the web and carry out sensitive transactions with peace of mind, knowing their data is safeguarded against theft or manipulation by malicious extensions.
