  Extensions provide useful additional functionality for web browsers, but are
also an increasingly popular vector for attacks. Due to the high degree of
privilege extensions can hold, extensions have been abused to inject
advertisements into web pages that divert revenue from content publishers and
potentially expose users to malware. Users are often unaware of such practices,
believing the modifications to the page originate from publishers.
Additionally, automated identification of unwanted third-party modifications is
fundamentally difficult, as users are the ultimate arbiters of whether content
is undesired in the absence of outright malice.
  To resolve this dilemma, we present a fine-grained approach to tracking the
provenance of web content at the level of individual DOM elements. In
conjunction with visual indicators, provenance information can be used to
reliably determine the source of content modifications, distinguishing
publisher content from content that originates from third parties such as
extensions. We describe a prototype implementation of the approach called
OriginTracer for Chromium, and evaluate its effectiveness, usability, and
performance overhead through a user study and automated experiments. The
results demonstrate a statistically significant improvement in the ability of
users to identify unwanted third-party content such as injected ads with modest
performance overhead.
