Hi, reviewing our Software inventory in fleet, I've came across some browser extensions which I found, looking at their names, inappropriate in a corporate environment. The investigation showed that those extensions were "just" themes. Technically osquery lists all extensions in

chrome_extensions

and fleet uses this table to fill the software inventory. However, from a security perspective a theme is a different story then code run by the browser and interacting with the user. So, I was wondering if it's possible to differentiate the two. I've not found a dedicated column for this in

chrome_extensions

, but looking into the extensions

manifest_json

provided an opportunity.

SELECT
  name AS name,
  version AS version,
  'Browser theme (Chrome)' AS type,
FROM users CROSS JOIN chrome_extensions USING (uid)
WHERE json_extract(manifest_json, '$.theme') <> ''

It would be great if fleet good differentiate "full blown extensions" from "just a theme". Not sure if my initial approach is a good fit and covers all scenarios. Maybe there are extensions which are both. I've also seen extensions which just provide a background. Maybe they have no

theme

in their manifest. Looking forward to a discussion of this topic and hopefully this is valueable enough to find a way into fleet. :)

Technically osquery lists all extensions in chrome_extensions and fleet uses this table to fill the software inventory. However, from a security perspective a theme is a different story then code run by the browser and interacting with the user.

Does the theme get installed as an extension? Regardless of what the extension does (apply a theme, for example), it's still a chrome extension

Yes, themes are installed as extensions. I think it would be great if we were able to differentiate extensions which just provide themes / backgrounds from other extensions.

hey! thanks for bringing this up! I have asked the team what is the best way to move this discussion forward (so it doesn't get silently lost here) will let you know when I know more

Thanks, Roberto, I'll raise an issue on Github shortly.