[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Emoboard Emoji Keyboard

Version 1.0.3 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Rating: 4.8 ★ (26 ratings)

Users: 20,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a decent user base of 20,000 users and maintains a strong 4.8-star rating from 26 reviews, suggesting users find it functional. However, the lack of visible developer information and company details reduces transparency and accountability.

Concerns: The primary concern is the excessive permissions for what should be a simple emoji keyboard tool. The <all_urls> host permissions and content script injection capabilities are completely unnecessary for an emoji keyboard, which should only need to insert emoji characters into text fields. These broad permissions create significant security risks, allowing the extension to access sensitive data on banking sites, social media, email platforms, and any other websites you visit. The combination of scripting permissions with universal website access means this extension could potentially log keystrokes, steal credentials, or modify website content across the entire web.

Recommendations: Given the high risk level, consider running this extension in a separate Chrome profile dedicated to non-sensitive browsing if you must use it. Better yet, look for alternative emoji keyboards with more appropriate, limited permissions. Most operating systems and many websites now have built-in emoji support that would be safer to use. If you continue using this extension, avoid accessing sensitive websites like banking or work-related sites while it's enabled, and regularly monitor your accounts for suspicious activity.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

alarms
storage
scripting

Host Permissions:

<all_urls>

Embedded URLs (38 total):

http://www.w3.org/2000/svg	https://cdn.jsdelivr.net/npm/@emoji-mart/data@latest/sets/
https://cdn.jsdelivr.net/npm/@emoji-mart/data@latest/i18n/	https://cdn.jsdelivr.net/npm/emoji-datasource-
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://reactjs.org/link/controlled-components	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	https://reactjs.org/link/dangerously-set-inner-html
https://reactjs.org/link/invalid-aria-props	https://reactjs.org/link/attribute-behavior
https://reactjs.org/link/crossorigin-error	https://reactjs.org/link/react-devtools
https://reactjs.org/link/unsafe-component-lifecycles	https://reactjs.org/link/derived-state
https://reactjs.org/link/legacy-context	https://reactjs.org/link/strict-mode-string-ref
https://reactjs.org/link/refs-must-have-owner	https://reactjs.org/link/warning-keys
https://reactjs.org/link/rules-of-hooks	https://reactjs.org/link/invalid-hook-call
https://reactjs.org/link/error-boundaries	https://reactjs.org/link/hooks-data-fetching
https://reactjs.org/link/setstate-in-render	https://reactjs.org/link/wrap-tests-with-act
https://reactjs.org/link/strict-mode-find-node	https://reactjs.org/link/switch-to-createroot
https://reactjs.org/link/react-polyfills	https://reactjs.org/docs/error-decoder.html?invariant=
https://reactjs.org/link/special-props	https://github.com/facebook/react/issues/3236
https://github.com/facebook/react/issues	https://www.google-analytics.com/mp/collect
https://www.google-analytics.com/debug/mp/collect	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://npms.io/search?q=ponyfill.	https://clients2.google.com/service/update2/crx

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "16": "icons/icon-16.png",
    "48": "icons/icon-48.png",
    "128": "icons/icon-128.png",
    "300": "icons/icon-300.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon-16.png",
      "48": "icons/icon-48.png",
      "128": "icons/icon-128.png",
      "300": "icons/icon-300.png"
    },
    "default_popup": "html/popup.html",
    "default_title": "__MSG_extName__"
  },
  "version": "1.0.3",
  "commands": {
    "_execute_action": {
      "suggested_key": {
        "mac": "Ctrl+Shift+E",
        "linux": "Alt+Shift+E",
        "windows": "Alt+Shift+E",
        "chromeos": "Alt+Shift+E"
      }
    }
  },
  "background": {
    "service_worker": "js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extShortDesc__",
  "permissions": [
    "alarms",
    "storage",
    "scripting"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/content.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "106.0"
}

by ✦ Astarte

Emoboard Emoji Keyboard

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (38 total):

Raw Manifest

Detections

Manifest Findings