Methods, media, and systems for screening malicious content from a web browser
Methods, media and systems for screening content for malicious content in a web browser are disclosed. Document object model (DOM) elements are retrieved from the content displayed in the web browser. A link to visit a web site included in the DOM elements is identified. The identified link is compared to a list of permitted sources. Information is scanned to determine whether the information matches records of content transmitted by a primary source among the permitted sources. An alert is generated after determining a mismatch between the information in the DOM elements and records of content transmitted by the primary source.
1. A method of screening content for malicious content in a web browser, the method performed by a web browser extension specific to a primary source, the method comprising:
retrieving document object model (DOM) elements from content displayed in the web browser;
identifying a link to a web site included in the DOM elements;
comparing the identified link to a list of permitted sources that includes the primary source;
determining, based on the list of permitted sources and a scan of information in the DOM elements, a mismatch between the information in the DOM elements and records of content transmitted by the primary source; and
generating an alert responsive to the determining the mismatch between the information in the DOM elements and the records of content transmitted by the primary source.
2. The method of claim 1 , the retrieving the DOM elements from the content includes retrieving the DOM elements before the content has been selected, accessed, or opened.
3. The method of claim 1 , wherein the content is an email message, the method further comprising:
accessing the email message via a virtual machine.
4. The method of claim 3 , further comprising preventing sharing of user information or cookies stored by the web browser.
5. The method of claim 3 further comprising transmitting the alert from the virtual machine to the web browser.
6. The method of claim 1 further comprising comparing the identified link to a list of prohibited sources prior to the comparing the identified link to the list of permitted sources.
7. A system comprising:
a memory; and
at least one processor coupled to the memory and configured to implement a web browser extension specific to a primary source to perform operations comprising:
retrieving document object model (DOM) elements from content displayed in a web browser;
identifying a link to a web site is included in the DOM elements;
comparing the identified link from a message analyzer to a list of permitted sources that includes the primary source;
determining, based on the list of permitted sources and a scan of information in the DOM elements, a mismatch between the information in the DOM elements and records of content transmitted by the primary source; and
generating an alert responsive to the determining the mismatch between the information in the DOM elements and the records of content transmitted by the primary source.
8. The system of claim 7 wherein the retrieving the DOM elements from the content includes retrieving the DOM elements before the content has been selected, accessed, or opened.
9. The system of claim 7 , the operations further comprising comparing the identified link to a list of prohibited sources prior to the comparing the identified link to the list of permitted sources.
10. The system of claim 7 , the operations further comprising accessing the content via a virtual machine that prevents sharing of user information or cookies stored by the web browser.
11. A non-transitory computer-readable medium storing instructions that when executed by one or more processors of a device cause the one or more processors to implement a web browser extension specific to a primary source to perform operations comprising:
retrieving document object model (DOM) elements from content displayed in a web browser;
identifying a link to a web site included in the DOM elements;
comparing the identified link to a list of permitted sources that includes the primary source;
determining, based on the list of permitted sources and a scan of information in the DOM elements, a mismatch between the information in the DOM elements and records of content transmitted by the primary source; and
generating an alert responsive to the determining the mismatch between the information in the DOM elements and the records of content transmitted by the primary source.
12. The non-transitory computer-readable medium of claim 11 , wherein the retrieving the DOM elements from the content includes retrieving the DOM elements before the content has been selected, accessed, or opened.
13. The non-transitory computer-readable medium of claim 11 , wherein the content is an email message, the operations further comprising:
accessing the email message via a virtual machine.
14. The non-transitory computer-readable medium of claim 13 further comprising preventing sharing of user information or cookies stored by the web browser.
15. The non-transitory computer-readable medium of claim 13 further comprising transmitting the alert from the virtual machine to the web browser.
16. The non-transitory computer-readable medium of claim 11 further comprising comparing the identified link to a list of prohibited sources prior to the comparing the identified link to the list of permitted sources.