Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it safe to use an untrusted bookmarklet on a web page containing sensitive data, for example internet banking page? In particular, can a bookmarklet send the data anywhere or execute some actions (like following links) on the page?

share|improve this question

migrated from stackoverflow.com Jan 23 '13 at 20:08

This question came from our site for professional and enthusiast programmers.

1  
This isn't really a programming problem, voting to migrate to SuperUser –  Darko Z Mar 1 '12 at 7:36

2 Answers 2

up vote 5 down vote accepted

Is it safe to use an untrusted bookmarklet on a web page containing sensitive data, for example internet banking page?

No.

In particular, can a bookmarklet send the data anywhere or execute some actions (like following links) on the page?

Yes.

A bookmarklet runs some JavaScript as if it were included on the page by the page author (with all the permissions that implies).

share|improve this answer
    
"as if it were included on the page by the page author." I think it can do even more, at least on some browsers it is closer to what a browser extension can do. –  Thilo Mar 1 '12 at 7:34
1  
@Thilo Bookmarklets get no special privileges in any of the newer version of IE, Firefox, or Chrome. I'm not as confident about Safari and Opera, but I seriously doubt it. But they are plenty dangerous enough without any special permission if you don't know what they do. Should generally avoid using them on on highly critical websites. –  DG. Mar 1 '12 at 15:11

No, it is not safe.

A bookmarklet can see everything on the page, read its cookies and its local storage, and interact with the server the page came from (and I even think other servers as well, as the cross-domain-sandboxing may not apply to bookmarklets).

share|improve this answer
1  
The same sandboxing applies to a bookmarklet as would apply to normal Javascript run on the page. –  DG. Mar 1 '12 at 15:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.