Connect-src is limited
Why it matters
CWE-200 (Exposure of Sensitive Information) applies when connect-src is unrestricted: an XSS vulnerability in an extension page could exfiltrate user data, stored credentials, or browsing history to an arbitrary attacker-controlled server if connect-src allows *. OWASP A05 (Security Misconfiguration) governs this: a CSP that restricts scripts but not network connections provides incomplete protection. An explicit connect-src allowlist is also a trust signal to users and Chrome Web Store reviewers — it makes explicit which servers the extension communicates with, which is a requirement for extensions handling sensitive user data.
Severity rationale
Low because exploiting an unrestricted `connect-src` requires a prior code execution vulnerability in the extension, but when that condition exists, the network exfiltration path is completely unblocked.
Remediation
Add an explicit connect-src directive in manifest.json CSP listing only the API backends your extension actually contacts.
"content_security_policy": {
"extension_pages": "script-src 'self'; object-src 'none'; connect-src 'self' https://api.yourdomain.com"
}
Do not use connect-src * or connect-src https: — these defeat the purpose of CSP network restrictions. If your extension uses WebSockets, add the wss:// equivalent of your backend explicitly.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Permissions & Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- owasp:2021 · A05
- external · chrome-csp-connect-src — Chrome Extensions: CSP connect-src
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-permissions-security·automated