Three security fixes in The Marvellous Suspender 9.1.0, and the people who found them
· 7 min read
TMS 9.1.0 is now on the Chrome Web Store, and with it we are publishing three security advisories that it closes. All three were reported privately, through the process described in our security policy, and kept private until the fixed version was available to everyone. This post explains what they were, credits the people who found them, and describes what changed.
TL;DR
- Update to 9.1.0. Chrome does this automatically. You can check your version under
chrome://extensions. 9.0.3 and earlier are affected. - GHSA-qv22-cq95-fcqr (moderate): a backup file with HTML in its filename could inject markup into the History page. Reported by @squeeze440.
- GHSA-wxv6-36j4-qw5f (moderate): any web page could inject markup into the suspended-tab page, and a malicious translation could do the same on any extension page. Reported and fixed by @amargiovanni.
- GHSA-wh6f-63h6-wvq6 (low): any other installed extension could suspend your tabs while skipping the protections you set, losing unsaved form input. Reported by @amargiovanni.
- None of these allowed running code: the extension's Content Security Policy blocks scripts on its pages. The risk was believable fake content (links, forms) shown on a page that looks like, and runs as, TMS.