How to deny Google Chrome extensions access to intranet content

Question

What I'm looking for is a domain (sub-domains included) restriction for extensions that require permissions to read content on the open tab.

This is just to make sure to provide the users with customization & at the same time, make sure that internal content is never sent outside the network un-intentionally.

Solution

All the settings currently available to you via Group Policy are listed on the Chromium site. You can block all extensions, then allow certain ones via a whitelist, but I don't see anything in there that does specifically what you want.

In terms of blocking access to extensions, they will have access to whatever the user running Chrome has access to. Since the extension can access the content after it has been downloaded by the browser, there is no way the server can control this access.

So your choices seem to be maintaining an approved list of extensions you aren't worried about, or making a custom version of Chrome (Chromium is Open Source) to distribute to users that includes the functionality you are looking for.

Reading the Chrome Extensions Developer Guide section on Content Scripts, particularly the sections on Execution Environment, Communication with the Embedding Page and Security Considerations, will give you a better understanding of how Chrome Extensions work, and may suggest where you have opportunities either working with Chromium, or customising extensions.

Or set up some sophisticated deep packet inspection firewall that can identify content you don't want to leak, which would have the additional benefit of covering all applications - but be rather expensive :-)

Comments

[Sujay]

I'm already using Blacklist * & Whitelist specific extensions. I just want to be able to selectively disable extensions for particular domains. So say for example an extension like SoundGecko, that can read the content of all open tabs & browsing history should not work on tabs that have an address in the format *.example.com.

[dunxd]

At the group policy level, I don't see any way to get what you want. I suggest you read the Chrome Extensions Developer Guide section on Content Scripts (developer.chrome.com/extensions/content_scripts.html). The sections on Execution Environment and Comminication with the Embedding Page and Security Considerations will give you a better understanding of how Chrome Extensions work, and may suggest where you have opportunities to achieve what you are seeking.

[Sujay]

I still think this question has not received enough attention(for which I started the bounty). Hence I'll Upvote your answer but don't know if I can accept your answer or give you the bounty. Thanks for the help.