That sounds about right. Browser extensions have an enormous amount of access (to perform legitimate actions) and would break a lot of security assumptions on websites. This goes far beyond refresh tokens in OAuth, as the extension can modify pages, steal data, trick users into doing things they don’t want to do, access cookies, etc. When securing web applications, one typically assumes that the application runs in a trusted environment, which consists of the browser, its extensions, the OS, and the hardware.
If you are looking for a secure option, using a BFF as described in the browser-based apps spec would be a first step, as it removes tokens from the browser. You could then look into augmenting the cookie-based session with features such as Device-Bound Session Credentials (DBSC). But even then, DBSC states that an attacker manipulating the user agent could circumvent this mechanism. Hope this helps Philippe — Pragmatic Web Security Security for developers https://pragmaticwebsecurity.com/ > On 19 Aug 2026, at 19:40, Neil Madden <[email protected]> wrote: > > If I understand this report correctly, you are worried that a malicious > browser extension has full control over a site's refresh tokens? And you are > specifically worried that detecting this via refresh token rotation leads to > a potential DoS/annoyance for the user? This feels like the least bad part of > that scenario to me, and very much working as designed. Such an attacker can > likely just directly revoke the refresh token rather than relying on RTR to > make that happen as a side-effect. > > The browser-based apps BCP doesn't consider malicious browser extensions. > Perhaps the authors could chime in here, but I would suspect it is because > the threat model is too strong: there is really very little you can do to > protect against such an attacker. > > -- Neil > >> On 15 Aug 2026, at 14:33, 이지용/학생/컴퓨터공학 <[email protected]> wrote: >> >> Hello, >> >> I am sharing a short report on an availability implication of refresh token >> rotation in browser-based applications. >> >> The report includes the threat model, abuse flow, practical evaluation, and >> a discussion of its implications for browser-based application guidance. >> >> I would appreciate any feedback on whether the threat model and availability >> framing are appropriate for the WG’s consideration. >> >> Best regards, >> JiYong Lee. >> <WG_Report.pdf>_______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected]
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
