Object sources are restricted
Why it matters
CWE-693 (Protection Mechanism Failure) captures the gap: an extension that restricts script-src but omits object-src still allows <object>, <embed>, and <applet> tags to load arbitrary plugins. Although Flash is dead, the attack vector persists because object-src defaulting to default-src is exploitable when default-src is permissive. OWASP A05 (Security Misconfiguration) applies: a CSP that looks correct but has an unconstrained fallback is misconfigured. Chrome's own CSP documentation explicitly recommends object-src 'none' as part of the minimal safe CSP for extension pages.
Severity rationale
High because a missing explicit `object-src` directive allows plugin-based content injection via `<object>` and `<embed>` tags, bypassing an otherwise hardened `script-src` policy.
Remediation
Add object-src 'none' explicitly to your extension pages CSP in manifest.json — do not rely on default-src fallback.
"content_security_policy": {
"extension_pages": "script-src 'self'; object-src 'none';"
}
Pair this with script-src 'self' so both directives are explicit. Auditors and the Chrome Web Store review team will flag any CSP where object-src is missing or permissive.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Permissions & Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-693 — Protection Mechanism Failure
- owasp:2021 · A05
- external · chrome-csp-object-src — Chrome Extensions: CSP object-src
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-permissions-security·automated