CRX aminer
[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]
Extension icon

1Password – Password Manager

Version 8.11.27.2 View in Chrome Web Store

Last scanned: about 21 hours ago

Extension Details

Developer: AgileBits Inc
Rating: 2.9 ★ (2.6K ratings)
Users: 6,000,000

Context-Aware Verdict

MEDIUM
Overall Risk
Trust Factors: 1Password is a well-established password manager from AgileBits Inc, a reputable company in the cybersecurity space. With 6 million users, it has significant market adoption. However, the relatively low rating of 2.9 stars is concerning and suggests user dissatisfaction, possibly related to functionality issues rather than security concerns.
Concerns: While the security analysis flags this as "Critical" risk, this appears to be based on a generic assessment that doesn't account for the legitimate needs of a password manager. The extensive permissions (downloads, management, privacy, tabs, webRequest, etc.) and broad host access are actually necessary for a password manager to function properly - it needs to inject into all websites to fill passwords, intercept requests to detect login forms, and manage browser privacy settings for secure operation. The WebAssembly execution capability is likely used for cryptographic operations. The main concern is the low user rating, which may indicate reliability or usability issues.
Recommendations: This extension requires extensive permissions by design, which is normal for password managers. The security findings are largely false positives given the extension's legitimate purpose. However, due to the low user rating, consider researching recent user reviews to understand current issues. If you're concerned about the broad permissions, you could run it in a separate Chrome profile, though this may limit its effectiveness. Given 1Password's reputation and the necessity of these permissions for password management functionality, the extension appears safe for its intended use despite the automated risk assessment.

Findings

HIGH
Broad Content Script Injection
This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.
HIGH
Broad Host Permissions
This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.
HIGH
High-Risk Permission: downloads
This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: management
This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: privacy
This extension has the privacy permission. Can modify privacy settings. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: tabs
This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: webNavigation
This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: webRequest
This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.
HIGH
Unsafe WebAssembly Execution
This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.
MEDIUM
Medium-Risk Permission: contextMenus
This extension has the contextMenus permission. Can add items to the context menu.
MEDIUM
Medium-Risk Permission: notifications
This extension has the notifications permission. Can show notifications.
MEDIUM
Medium-Risk Permission: storage
This extension has the storage permission. Can store data locally.
by ✦ Astarte