Base URI is restricted
Why it matters
Base tag injection (CAPEC-86) is a real attack: if an attacker can inject <base href="https://evil.com/"> into an extension page via DOM XSS, all relative URLs in that page — scripts, images, API calls — resolve to the attacker's server. CWE-16 (Configuration) names the failure: omitting base-uri from CSP leaves a bypass path for XSS that circumvents script-src. OWASP A05 (Security Misconfiguration) applies. Setting base-uri 'none' costs nothing and closes a class of attack that bypasses otherwise correct CSP configurations. Chrome extension security guidance lists this as a required directive for hardened CSPs.
Severity rationale
Medium because base tag injection requires a prior XSS opportunity, but when that condition exists, it redirects all relative resource loads to an attacker-controlled origin.
Remediation
Add base-uri 'none'; to your CSP string in manifest.json. This prevents any <base> tag from taking effect, even if one is injected via XSS.
"content_security_policy": {
"extension_pages": "script-src 'self'; object-src 'none'; base-uri 'none'"
}
Prefer 'none' over 'self' for base-uri — extension pages rarely need a <base> tag, and 'none' is the stricter posture.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Permissions & Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-16 — Configuration
- owasp:2021 · A05
- capec · CAPEC-86 — XSS via HTTP Query Strings (base tag injection variant)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-permissions-security·automated