Audit and Remediation: Failed To Read manifest.json Error When Querying Browser Extensions

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)

Issue/Introduction

Issuing a Live Query for a list of installed browser extensions returns no matched results for a single endpoint, only an error similar to:

Failed to read the following manifest.json file: C:\Path\To\manifest.json. The extension was referenced by the following profile: C:\Users\Username\AppData\Local\Publisher\Browser\User Data\Default

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Windows Sensor: All Supported Versions

Cause

• The specified manifest file is missing, corrupt, or unreadable, which causes osquery to return this error.
• Upon receiving this error, the Sensor aborts the query altogether and no matched results are collected.

Resolution

• This issue is being tracked under EA-23689 and expected to be addressed in a future Sensor release with the resolution of DSEN-26565 by no longer aborting the query when this non-critical error is received.
• In the meantime, no known workarounds exist on machines where a manifest.json file cannot be read, other than restoring the referenced file.

Additional Information

• Every extension requires a JSON-formatted file containing basic metadata about the extension, including name and version details.
• Systems with no unreadable manifest files are expected to return matched results in Live Query for any installed extension that fit the query criteria.
• Earliest expectations on a pending fix should be the 4.1 Sensor in Q1 2024.