In a preview of a demonstration at the upcoming Black Hat security conference, a security researcher has demonstrated how browser extensions can be used to compromise Chrome OS. WhiteHat Security specialist Matt Johansen reported spreading a note containing malicious code via the ScratchPad extension.
The Chrome extension ScratchPad has a wide range of permissions that made it vulnerable to a cross-site scripting attack, Matt Johansen, an application security specialist at WhiteHat Security, said July 14 in a preview of a presentation he will be making at Black Hat.
Johansen did his work on the Google CR-48 Beta laptop released last fall, but said malicious extensions would affect any device... »read more

More at: Linux for Devices Add additional source