  Browser extensions are small applications executed in the browser context
that provide additional capabilities and enrich the user experience while
surfing the web. The acceptance of extensions in current browsers is
unquestionable. For instance, Chrome's official extension repository has more
than 63,000 extensions, with some of them having more than 10M users. When
installed, extensions are pushed into an internal queue within the browser. The
order in which each extension executes depends on a number of factors,
including their relative installation times. In this paper, we demonstrate how
this order can be exploited by an unprivileged malicious extension (i.e., one
with no more permissions than those already assigned when accessing web
content) to get access to any private information that other extensions have
previously introduced. Our solution does not require modifying the core browser
engine as it is implemented as another browser extension. We prove that our
approach effectively protects the user against usual attackers (i.e., any other
installed extension) as well as against strong attackers having access to the
effects of all installed extensions (i.e., knowing who did what). We also prove
soundness and robustness of our approach under reasonable assumptions.
