How can we Disable auto update for browser extensions?

Browser Support Desktop Support
, , , ,
1

Why is brave still unwilling to look or prioritize this massive security issue?

Yesterday “Save as type” extension got caught running shady code.

2

bump up … come on brave. what’s your hold up on this?

3

This is something I’d like as well. Not all updates are good (bugs, or shady updates as mentioned), and sometimes we wish to delay our updates for full vetting.

4

Whether extensions are “good” or “bad” — undeniably — extensions that may at one time have been “good” do go bad.

This is an old link. While the date is 6 years ago, the message remains valid today:

Here’s another story about a different extension that went “bad”:

Both these links tell the same story: an extension that initially behaved well was sold to a malevolent purchaser.

Firefox gives users control (as an option) over if / when to update installed extensions. I’m unaware of any chromium-based browser offering this option — which is what this thread is about.

Bottom line: be very cautious about installing / using extensions.

My experience: in addition to my password manager, I have only 3 active extensions installed.

5

@hmazuji let’s keep this thread alive since yours got automatically closed.

6

The following extension is no longer available at the Chrome Web Store:
‘https://chromewebstore.google.com/detail/kdenlnncndfnhkognokgfpabgkgehodd/error’

That extension was a source of trouble, reported here at the Brave Community:
‘Google Chrome Update message keeps popping up’
‘Google Chrome Update message keeps popping up - #15 by HeisDeisk’

The trouble: The extension itself did not reveal malware when scanned, but the extension [somehow] downloaded a process/script that caused the following fraudulent pop-up to be displayed:

I had an iOS app go bad - the owner sold it, and the buyer converted it to connect to some osbscure websites ← I learned, when the app misbehaved (it had been reliable for 7 years).

And recently, I had a Chrome Web Store extension suddenly go bad, producing a pop-up similar to the fraudulent pop-up mentioned herein.

GitHub member ‘chewybone’ is correct:
‘https://github.com/brave/brave-browser/issues/7200#issuecomment-3787902813’

7

This world of auto updating is a double edged sword. Certainly there needs to be a way to disable auto updates of extensions added as a feature.

At the moment there is a substantial issue around malware and browser extensions.

Read More :slight_smile: via link. That link has caused issues when shared on this forum but if the moderators remove the link search for information about shady panda.

Note to moderators please just edit the message and remove link if it is a problem as more people need to know about the situation.

8

i think this is finally getting traction. hurray.

9

we are a few steps away https://github.com/brave/brave-core/pull/35301#issuecomment-4235023416

I believe that we would expect the feature to be added in June’s release based on the release schedule:

10

Good news.

IMHO, offering this through a user-edited flag is probably prudent. Being honest: most folks will ignore this — perhaps to their regret, but that’s another story.

My one-and-only concern: user-edited flags come and go; I’d like this flag (and being able to edit it) to be permanent.

11

Agreed. it was a cheap way to get this implemented. but happy it finally made it after the pressure was mounting on them.