Links
Comment on page

Browser Extension Security

Controlling Access to Hosts/Origins

Access to hosts/origins is controlled via the runtime_blocked_hosts and runtime_allowed_hosts policies. See Configure ExtensionSettings policy for more information
For example, to only allow PixieBrix to modify the example.com domain, provide the following settings:
  • runtime_blocked_hosts
    • *://*
  • runtime_allowed_hosts
    • https://*.pixiebrix.com
    • https://*.example.com

Frequently Asked Questions (FAQs)

What security certifications do you have?

PixieBrix has completed a SOC-2 Type 2 with A-LIGN covering the following trust criteria:
  • Security
  • Availability
  • Confidentiality

Is the browser extension source available?

What browser permissions does PixieBrix's extension require?

Has a 3rd party audited the PixieBrix Browser Extension?

  • In July 2023, the latest independent penetration test by A-LIGN included the Browser Extension in the test scope. The penetration test report is available upon request
  • In August 2023, PixieBrix completed the Google Cloud Application Security Assessment (CASA)
  • The Google Chrome Web Store team reviews the extension prior to publishing in the Chrome Web Store

Could you explain your CRXcavator Extension Risk Report?

CRXcavator is a tool from Duo Security to assess the risk of Browser Extensions automatically. As an automated scanning tool, its results must be put into context due to false positives.
Relative Risk Scores of Other Extensions
The PixieBrix extension is a leader compared to other enterprise automation extensions:
Permissions
See the Extension permissions section of our Privacy Policy for a full explanation of what permissions our extension requests and why.
The Chrome Web Store team reviews the extension with respect to the stated purpose of each permission.
The main permissions risks flagged by CRXcavator are:
  • *://*/* host permission. PixieBrix includes support for running on any page/calling any API. As an IT admin, you can set the Chrome Extension policy to override this permission to allow/forbid certain origins
  • <all_urls> host permission. This permission is required for certain behaviors for compliance use cases (e.g., screenshot capture). As an IT admin, you can set the Chrome Extension policy to override this permission to allow/forbid certain origins
  • tabs permission. PixieBrix must be able to monitor tab events for navigation and cross-tab messaging/automation. PixieBrix does not transmit/collect information about URLs
Content Security Policy (CSP)
CRXcavator evaluates the extension’s Content Security Policy in the manifest. However, sub-components of the PixieBrix extension apply stricter policies where possible. The CRXcavator describes their point system for the Content Security Policy here
The main CSP risks included in the CRXCavator score are:
  • connect-src: https:. Required for PixieBrix to be able to be make API calls for integrations
  • frame-src: https:. Required to support embedding iframes in custom panels.
  • image-src: https:. Required to support embedding logos/images for theming and custom panels
  • script-src: unsafe-eval:. Required for dynamic page modification and templating. PixieBrix does not request external Javascript
External Communications
CRXcavator scans for URLs/hostnames, including in locations that are not executed/interpreted
  • reactjs.org: false positive, the React web framework’s documentation site
  • jsonschema.org: false positive, PixieBrix uses the JSON Schema standard for input and output schemas. It does not connect to the site
  • app.pixiebrix.com: for API calls to the primary PixieBrix service