Building a Browser Extension that Talks to Your OS (Code Execution): How an adversary can talk natively (Dive into Chrome Native Messaging)

How to build a Microsoft Edge extension that launches native applications using Chrome’s Native Messaging API

In this post, I’ll walk you through building a practical example: a Microsoft Edge extension that launches Notepad (or any native application) using Chrome’s Native Messaging API. We’ll cover the architecture, implementation, security considerations, and provide complete working code.

This code execution method isn’t well documented and threat actors are using it for launching Windows native apps, running scripts and exploiting deeper organizations.

What is Chrome Native Messaging?

Chrome Native Messaging is a communication protocol that allows browser extensions to exchange messages with native applications installed on the user’s computer. Think of it as a secure pipe that connects JavaScript running in your browser to programs running on your operating system.

Why “Chrome” Native Messaging in Edge?

Microsoft Edge is built on Chromium, the same open-source project that powers Google Chrome. This means Edge supports all the same APIs, including Native Messaging. In fact, Edge extensions use the exact same chrome.runtime API namespace!

The Communication Flow and Code Execution

┌─────────────────────────────────────────────────────────────┐
│                    Browser (Microsoft Edge)                  │
│                                                               │
│  ┌──────────┐           ┌──────────────┐                    │
│  │ Popup UI │ ────────→ │  Background  │                    │
│  │          │  message  │    Script    │                    │
│  └──────────┘           └──────┬───────┘                    │
│                                 │                             │
│                                 │ chrome.runtime              │
│                                 │ .connectNative()            │
└─────────────────────────────────┼─────────────────────────────┘
                                  │
                                  │ Native Messaging Protocol
                                  │ (stdin/stdout + JSON)
                                  │
┌─────────────────────────────────┼─────────────────────────────┐
│                        Operating System                       │
│                                 │                             │
│                         ┌───────▼──────────┐                 │
│                         │  Native Host     │                 │
│                         │  (Python Script) │                 │
│                         └───────┬──────────┘                 │
│                                 │                             │
│                         subprocess.Popen()                    │
│                                 │                             │
│                         ┌───────▼──────────┐                 │
│                         │   notepad.exe    │                 │
│                         └──────────────────┘                 │
└─────────────────────────────────────────────────────────────┘

Step 1 — The Browser Extension

• Popup UI — What users interact with (Optional)
• Background Script — Manages the native messaging connection
• Manifest — Declares permissions and configuration

Step 2 — The Native Messaging Host

• A Python script that receives commands from the browser
• Executes system-level operations (like launching Notepad)
• Sends responses back to the extension

The protocol is simple but must be followed exactly:

┌─────────────────────────────────────────┐
│         Message Format                   │
├─────────────────────────────────────────┤
│  [4 bytes]  Message Length (uint32)     │
│  [N bytes]  JSON Message                │
└─────────────────────────────────────────┘

Step 3 — The Native Messaging Manifest

• A JSON configuration file
• Tells the browser where to find the native host
• Whitelists which extensions can connect (security!)

This JSON file tells the browser where to find your native host:

{
  "name": "com.notepad.launcher",
  "description": "Native messaging host for Notepad Launcher",
  "path": "C:\\Users\\<username>\\notepad-launcher\\native_host.py",
  "type": "stdio",
  "allowed_origins": [
    "chrome-extension://YOUR_EXTENSION_ID_HERE/"
  ]
}

The allowed_origins array whitelists which extensions can connect. Only extensions with matching IDs can use your native host. This prevents other extensions from hijacking your native application.

The browser needs to know about your native host. On Windows, this is done via the registry:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Edge\NativeMessagingHosts\com.notepad.launcher]
@="C:\\path\\to\\com.notepad.launcher.json"

For Chrome, the path is:

HKEY_CURRENT_USER\Software\Google\Chrome\NativeMessagingHosts\com.notepad.launcher

On macOS/Linux: Copy the manifest to:

• Edge: ~/Library/Application Support/Microsoft Edge/NativeMessagingHosts/
• Chrome: ~/.config/google-chrome/NativeMessagingHosts/

Installation Steps

Step 1 — Download and install the extension

git clone https://github.com/tasox/browser-extension-for-code-exec

1. Navigate to edge://extensions/
2. Enable "Developer mode"
3. Click "Load unpacked"
4. Select your extension folder
5. Copy the Extension ID (e.g., "abcdefghijklmnopqrstuvwxyz123456")

Step 2 — Configure Native Host

1. Update com.notepad.launcher.json:
   - Replace YOUR_EXTENSION_ID_HERE with your actual ID
   - Set "path" to your Python script location

2. Make Python script executable (Mac/Linux):
   chmod +x native_host.py

Step 3 — Register with Browser

Windows:

1. Edit install_host.reg with your manifest path
2. Double-click to import into registry
3. Restart Edge

macOS/Linux:

# Create directory
mkdir -p ~/Library/Application\ Support/Microsoft\ Edge/NativeMessagingHosts/

# Copy manifest
cp com.notepad.launcher.json ~/Library/Application\ Support/Microsoft\ Edge/NativeMessagingHosts/

Testing

1. Click the extension icon in Edge
2. (Optional) Enter a file path
3. Click "Launch Notepad"
4. Notepad should open!

Launching Notepad via MsEdge

Process Tree:

• **Grand Parent** -> Msedge.exe / Chrome.exe or any other Chromium browser
• Parent -> Cmd.exe / Powershell.exe
• Parent commandline:

C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\Users\user\Desktop\Msedge_extension\notepad-launcher\native_host.py" chrome-extension://bgopihobgfaakkoclgkkfkkmmhjjpjjm/ - parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.922bf73e45672894 > \\.\pipe\chrome.nativeMessaging.out.922bf73e45672894

• Child -> Notepad.exe

Threat Hunting

if you are lucky enough to have a browser extension that collects all these useful data from users’ browsers then it’s easy to build a baseline. However, if you belong the unfortunate category then:

• Inspect the command-line arguments for the MsEdge/Chrome or any other chromium browser that you might use.
• Investigate child processes that have been spawned by MsEdge/Chrome and particular any Lolbin with higher attention to cmd.exe or powershell.exe
• Expect more than a simply “Whoami” or “notepad.exe”. Correlate the activities, build a baseliner and look for anomalies around the time where the extension installed.