HirePro Assessment – disable-extensions PoC

in validation—any sender is accepted."},{"icon":"service_worker","actor":"service_worker","label":"Background relays command","detail":"The content script forwards a 'disable' message to the background service worker."},{"icon":"extension","actor":"extension","label":"All extensions disabled","detail":"The background calls chrome.management.getAll() then chrome.management.setEnabled(id,false) for every installed extension except itself."},{"icon":"storage","actor":"extension","label":"IDs saved to localStorage","detail":"Disabled extension IDs are written to localStorage under 'disableExtensionsList' on the triggering page."}],"blocks":[{"kind":"cause_effect","trigger":{"actor":"remote","detail":"Any page at any origin posts window.postMessage({message:'enableChecking'},'*')—no user interaction is required.","summary":"A web page sends a postMessage to the extension's content script."},"response":{"actor":"extension","detail":"The background service worker calls chrome.management.setEnabled(id,false) for each extension returned by chrome.management.getAll(), except HirePro Assessment itself.","summary":"The extension disables every other installed browser extension."},"technicalNote":"content.js:1 registers window.addEventListener('message',(event)=>{...}) with no event.origin check. Branches on event.data.message==='enableChecking' (line 2). Sends chrome.runtime.sendMessage({message:'disable'}) to background.js which calls chrome.management.getAll then chrome.management.setEnabled(id,false) in a Promise.allSettled loop (background.js:7-38). manifest content_scripts matches '*://*/*'."},{"kind":"code_compare","caption":"Content script postMessage listener — no origin check","shipped":"window.addEventListener(\"message\", (event) => {\n if (event.data.message === \"enableChecking\") {\n window.postMessage({ message: \"checkingDone\"}, \"*\");\n var disableExtensionsList = localStorage.getItem('disableExtensionsList') ? JSON.parse(localStorage.getItem('disableExtensionsList')) : [];\n disableExtensions();\n async function disableExtensions() {\n try {\n const response = await chrome.runtime.sendMessage({\n message: \"disable\",\n });\n ...\n }\n }\n }\n});","language":"js","deobfuscated":"$25"},{"kind":"code_compare","caption":"Background handler — disables all extensions via chrome.management","shipped":"chrome.runtime.onMessage.addListener(function (request, sender, sendResponse) {\n if (request.message === \"disable\") {\n var disableExtensionsList = [];\n var disabledExtensions = [];\n var extensionsFailedToDisable = [];\n var disableExtensionsPromises = [];\n chrome.management.getAll(function (extensions) {\n extensions.forEach(function(extension) {\n if (extension.name !== \"HirePro Assessment\" && extension.enabled == true) {\n var disablePromise = chrome.management.setEnabled(extension.id, false)\n ...\n }\n });\n Promise.allSettled(disableExtensionsPromises).then(function() {\n sendResponse({ ... });\n });\n });\n }\n return true;\n});","language":"js","deobfuscated":"$26"},{"code":"\n\nHirePro Assessment – disable-extensions PoC\n\n

HirePro Assessment extension – missing origin check PoC

Click the button. The HirePro content script will disable all other installed extensions.

\n \n

Waiting…

Is HirePro Assessment safe?

Findings