1538536 - Extension Block Request: TxP

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, task)

Description

[Zitronella]

Extension name	TxP
Extension versions affected	<all versions>
Platforms affected	<all platforms>
Block severity	hard

Reason

Remote script injection
Search hijacking

Extension GUIDs

{54c7e57f-8ef0-48d5-92a0-6e95d193a12c}
{32d262da-e3cd-4300-aa0b-c284eb4e17bf}

Comment 1

[Zitronella]

after installing this extension, it is not possible to uninstall, because i can not open about:addons, it opens only google.

Comment 2

[Zitronella]

There is a high security risk for users when installing such an extension. It must not be possible that basic functions of Firefox be annulled by extensions.

Comment 3

[Daniel Veditz [:dveditz]]

Jorge: looks like Andreas is on vacation. Who else should look into things like this?

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Philipp can look into this.

Comment 5

[Philipp Kewisch [:Fallen][📱📆]]

This doesn't look like it needs to be a security sensitive bug. We are aware add-ons have the possibility to avoid about:addons, unfortunately there are enough ways for malicious developers to do this, even with just the tabs API.

Comment 6

[Philipp Kewisch [:Fallen][📱📆]]

Reasons: Search hijacking and avoiding about:addons. Masking as legit add-on.

Comment 7

[Philipp Kewisch [:Fallen][📱📆]]

The block has been staged. Andreas, can you review and push?

Comment 8

[Stuart Colville [:muffinresearch]]

Approved and pushed