chrome_extensions table does not report extensions bundled with browsers
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
Bug report
What operating system and version are you using?
version = 10.15.4
build = 19E234g
platform = darwin
What version of osquery are you using?
version = 4.2.0
What steps did you take to reproduce the issue?
run select * from users join chrome_extensions using (uid); or select * from chrome_extensions;
What did you expect to see?
all extensions which a browser would load, including those which are bundled with browsers.
for example, chrome comes with a few "invisible" extensions which may not be visible in chrome://extensions but they are in chrome://system under extensions. this includes things like kmendfapggjehodndflmmgagdbamhnfd (CryptoTokenExtension) or gfdkimpbcpahaombhbimeihdjnejgicl (Feedback). Microsoft Edge has a bunch too, like:
dgiklkfkllikcanfonkcabmbdfmgleag : Microsoft Clipboard Extension : version 1_0
fikbjbembnmfhppjfnmfkahdhfohhjmg : Media Internals Services Extension : version 2_0_0
fogppepbgmgkpdkinbojbibkhoffpief : Edge Collections : version 1_0
iglcjdemknebjbklcgkfaebgojjphkec : Microsoft Store : version 0_2
ihmafllikibpmigkcoadcmckbfhibefp : Edge Feedback : version 1_0_0_1
jdiccldimpdaibmpdkjnbmckianbfold : Microsoft Voices : version 1_0
kmendfapggjehodndflmmgagdbamhnfd : CryptoTokenExtension : version 0_9_74
mhjfbmdgcfjbbpaeojofohoefgiehjai : Microsoft Edge PDF Viewer : version 1
ncbjelpjchkpbikbpkcchkhkblodoama : WebRTC Internals Extension : version 2_0_0
What did you see instead?
only extensions which are installed in a browser profile.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the two queries against the chrome_extensions table on macOS 10.15.4 with osquery 4.2.0, comparing installed profile extensions with the bundled extensions listed in chrome://system. Done means the table reports browser-bundled extensions as well as profile-installed extensions, including the examples in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100