diff options
| author | Yuval Adam <_@yuv.al> | 2026-02-26 08:58:17 +0100 |
|---|---|---|
| committer | Yuval Adam <_@yuv.al> | 2026-02-26 08:58:17 +0100 |
| commit | 54adf11e1c8905c97512fcf29d8b3d75aa9eb0cb (patch) | |
| tree | 06d502c0de78b4a8c3ef29bff84fe7f59ff2c069 /README.md | |
Initial security review docs for 1Password Firefox extension v8.12.2.38
Static analysis of the extracted XPI covering:
- Architecture: runtime topology, WASM modules, boot sequence, permissions
- Message catalog: ~50 background handlers, per-file content script messages
- WebAuthn analysis: page-world monkey-patching, postMessage IPC protocol
- Trust boundaries: 8 zones, 7 crossings, data lifecycle, attack surfaces
- Telemetry: Snowplow, Sentry, DNS privacy proxy, opt-out controls
- TODO: prioritized future work plan
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/README.md b/README.md new file mode 100644 index 0000000..8ad8c35 --- /dev/null +++ b/README.md @@ -0,0 +1,21 @@ +# 1Password Firefox Extension Security Review + +Static analysis of the 1Password browser extension for Firefox (`1pass-xpi`), version **8.12.2.38** (stable channel, built 2026-02-11). + +## Documentation + +| File | Description | +|------|-------------| +| [architecture.md](architecture.md) | Runtime topology, boot pipeline, permission model, WASM modules | +| [message-catalog.md](message-catalog.md) | Complete message handler map extracted from source | +| [webauthn-analysis.md](webauthn-analysis.md) | WebAuthn monkey-patching, page-world IPC protocol, attack surface | +| [trust-boundaries.md](trust-boundaries.md) | Trust zones, dataflow, sensitive data classes, attack surfaces | +| [telemetry.md](telemetry.md) | Snowplow analytics, Sentry error reporting, DNS privacy proxy | +| [TODO.md](TODO.md) | Planned future work and open questions | + +## Source Material + +- `1pass-xpi/` — Extracted extension package (XPI/ZIP), Mozilla-signed +- Extension ID: `{d634138d-c276-4fc8-924b-40a0ea21d284}` +- Manifest version: 2 (Firefox) +- Gecko minimum: 128.0 |