There are myriad attacks that could be executed with a spoofed extension; the most obvious of these would be to create and sign a traffic logger to capture a victim’s Web activity. The researcher also produced a proof-of-concept of a spoofing attack and written up instructions on how to remove the extension.
Yahoo has since posted a replacement Web search extension that does not include the private half of the security certificate.
What is Axis? Axis is a new search and browsing tool from Yahoo that was released on Wednesday. It is available for desktop computers, as an extension for Google Chrome, Mozilla Firefox, Internet Explorer and Safari, as well as for iOS devices, as a stand-alone app.
Source: http://www.theregister.co.uk/2012/05/24/yahoo_ships_private_certificate_by_accident/
Source: http://securitywatch.pcmag.com/web-browsers/298353-yahoo-updates-axis-chrome-extension-removes-private-key
Source: http://www.pcworld.com/article/256182/yahoo_leaks_private_key_allows_anyone_to_build_yahoosigned_chrome_extensions.html
Source: http://www.geek.com/articles/news/yahoo-axis-chrome-extension-leaks-private-key-20120524/
Source: http://www.computerworld.com/s/article/9227453/Yahoo_leaks_private_key_allows_anyone_to_build_Yahoo_signed_Chrome_extensions
