CRX aminer
[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]
Extension icon

1Password – Password Manager

Version 8.12.12.44 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: AgileBits Inc
Rating: 2.9 ★ (2.7K ratings)
Users: 6,000,000

Context-Aware Verdict

MEDIUM
Overall Risk
Trust Factors:

1Password is developed by AgileBits Inc, a well-established and reputable company in the password management industry with over a decade of experience. The extension has 6 million users, indicating widespread adoption and trust. However, the relatively low rating of 2.9 stars from 2.7K reviews raises some concerns about user satisfaction, though this could be related to functionality issues rather than security problems.

Concerns:

While the security analysis flags numerous high-risk permissions, these are largely necessary for a password manager to function effectively. The extension needs broad access to inject autofill functionality across all websites, manage downloads for secure file sharing, and interact with browser tabs for seamless password management. The WebAssembly execution capability is concerning but may be required for cryptographic operations. The main red flag is the low user rating, which suggests potential reliability or usability issues.

Recommendations:

Given 1Password's strong reputation and the functional necessity of most permissions for password management, this extension is generally trustworthy despite the technical risk flags. However, due to the low user rating, consider researching recent user complaints to understand current issues. If you're concerned about the broad permissions, you could run it in a separate Chrome profile or consider alternative password managers with higher user satisfaction ratings. Ensure you're using the official 1Password desktop application alongside the extension for maximum security.

Findings

HIGH
Broad Content Script Injection
This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.
HIGH
Broad Host Permissions
This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.
HIGH
High-Risk Permission: downloads
This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: management
This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: privacy
This extension has the privacy permission. Can modify privacy settings. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: tabs
This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: webNavigation
This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: webRequest
This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.
HIGH
Unsafe WebAssembly Execution
This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.
MEDIUM
Medium-Risk Permission: contextMenus
This extension has the contextMenus permission. Can add items to the context menu.
MEDIUM
Medium-Risk Permission: notifications
This extension has the notifications permission. Can show notifications.
MEDIUM
Medium-Risk Permission: storage
This extension has the storage permission. Can store data locally.
by ✦ Astarte