When Extensions Lie: Large-Scale Study of Privacy Policy Compliance in Browser Extensions

Abstract

Browser extensions can pose significant privacy risks to end users due to their complex permission mechanisms and high privilege levels. Modern websites increasingly embed sensitive personal data within HTML elements, making such threats even more insidious. Although prior studies have examined browser extension privacy risks from different perspectives, they are typically constrained to specific sensitive data sources or a set of extensions tested on a few popular websites. To enable a comprehensive compliance check of browser extensions' privacy practices at scale, we develop an automated dynamic analysis framework, ExtPolice. It applies LLM-based techniques to identify sensitive web content embedded in web pages, performs a multi-type taint analysis in the browser to comprehensively track sensitive data flows across browser components, and checks the compliance of such flows against the extension's privacy policy disclosures. We apply ExtPolice to evaluate 149,216 Chrome extensions across 7,200 unique web pages and identify 2,246 extensions with policy violations, enabling scalable analysis of policy compliance for browser extensions. Our study uncovers thousands of policy violations potentially affecting up to tens of millions of users, highlighting major gaps in current extension-store review processes.