Environment
- Carbon Black Cloud Console: All Versions
- Carbon Black Cloud Sensor: All Supported Versions
Question
Why do Live Query results for the "Chrome Extensions" query include extensions from non-Chrome browsers?
Answer
- The chrome_extensions table in osquery stores details for all Chromium-based browsers, like Edge, Brave, and Opera.
- As a result, a query against this table will return extensions installed on any Chromium browsers on the endpoint, unless a WHERE clause is used to filter by browser_type. Example:
SELECT username,
DIRECTORY,
shell,
TYPE,
name,
VERSION,
locale,
update_url,
author,
persistent,
PATH
FROM users
JOIN chrome_extensions USING (UID) WHERE browser_type = 'chrome';
Related Content
