Underc0ver — Retrospective Case Study (Chromebook monitoring & protocol isolation)

Status: Archived (historical research). Summary: As a teenager I discovered that certain ChromeOS classroom-monitoring extensions were constrained to HTTP/HTTPS. A local HTML page could leverage a different URL scheme to evade those extensions’ visibility. The vendor patched the issue in IMTLazarus v16.27; this repo preserves a sanitized write-up and safe demo for educational purposes only.

No exploit code is included. This repository documents the finding, the conditions that enabled it, and lessons about extension permission scoping and protocol isolation.

---

Background

Many ChromeOS screen-monitoring tools are distributed as extensions, which only receive the capabilities they explicitly request. At the time of the finding (years ago), at least one product’s policy set allowed HTTP/HTTPS access but did not grant visibility into other schemes. That gap enabled a local page to operate beyond the extension’s sightline. The vendor later closed the gap in v16.27.

What this repo contains

• report.md: a clear, English write-up of the original observation, threat model, minimal PoC design (described, not provided), impact, and remediation timeline.
• demo.html: a benign HTML page demonstrating how browser capabilities can differ by protocol without bypassing anything.
• /assets: diagrams illustrating the extension permission boundary and protocol flows.
• This README.md: overview & ethics.

Ethics & scope

• For defensive research and educational discussion. No code that circumvents monitoring or policy is provided.
• Do not attempt to reproduce on systems you don’t own or administer.
• If you maintain monitoring software, use this case study to ensure your extension/service covers the URL schemes and contexts your threat model requires.

Key takeaways

• Extensions enforce capabilities by permission, which can leave blind spots across URL schemes if not explicitly handled.
• Protocols like file: and sandboxed/isolated contexts may require additional architectural coverage beyond typical webRequest/content-script scopes.
• Patch management and clear disclosure processes are essential to minimize exposure windows.

Timeline (high-level)

• Initial observation: in 2020 (as a student; details in report.md).
• Vendor remediation: noted as patched in IMTLazarus v16.27.
• Repository archived: June 25, 2022.

Citation

If you reference this work:

Mateo (Underc0ver). "Protocol Isolation & Extension Blind Spots on ChromeOS." Archived case study, patched in IMTLazarus v16.27. https://github.com/mateoltd/underc0ver