Thanks for the info about this.
How certain are you regarding this information? (say on a scale of 1 to 10).
Putting answers on a scale is quite hard.
Let me rephrase it:
1) There is no known chrome vulnerability currently (IF you are on the latest version) to break out of the sandbox.
This means that there is no way for an attacker to access your filesystem or your saved passwords.
The very tiny chance that he used a 0-day-exploit exists, but is negligibly small (especially considering that this is a 'simple add-on scam').
This means that:
- Your saved passwords should be safe
- Any keepass database or any other files on your harddrive should be safe
- Your machine should be clean
Definitely tell your admin to check which browser version he has used. If it was not the latest, we have to dig further to find out if there are vulnerabilities which would allow to break out of the sandbox.
2) Depending on the permissions your administrator gave to the extension (assuming all have been granted):
- Chances are VERY high that each password entered into the browser while the addon was active has been compromised
- Chances are VERY high that ANY information entered into the browser while installed has been compromised
I hope this is enough information for you. Rating it on a scale between 1 and 10 wouldn't be close to professional.
Left to me, i will say 7 out of 10. Always use a local password manager like KeePass
What ?
1) I don't think he has asked you.
2) I made 6 different statements. How can you simply say "7 out of 10"
3) It is not about password manager. Even using a password manager would have caused the theft of the funds. Please read the whole thread.
