[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Naruto 2021 Wallpapers and New Tab

Version 0.0.1 View in Chrome Web Store

Last scanned: about 11 hours ago

Extension Details

Rating: 5.0 ★ (3 ratings)

Users: 770

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has very limited user adoption with only 770 users and just 3 reviews, making it difficult to assess reliability through community feedback. The perfect 5.0 rating is based on an extremely small sample size. The lack of developer information and missing last updated date raises transparency concerns. The extension appears to be a simple wallpaper/new tab customization tool focused on Naruto anime content.

Concerns:

- Uses outdated Manifest V2, which has weaker security protections compared to V3

- Extremely low user base and minimal review history provide insufficient validation

- Missing developer contact information and update history reduce accountability

- No visible permissions listed, but CSP allows external script sources from multiple CDNs (Google, FontAwesome, StackPath, Cloudflare) which could potentially be exploited

- Version 0.0.1 suggests this is an initial release that may not have undergone thorough testing

Recommendations:

Consider running this extension in a separate Chrome profile if you choose to use it, given the combination of outdated manifest version and limited community validation. Monitor for any unusual browser behavior after installation. Look for alternative Naruto wallpaper extensions with larger user bases, more recent updates, and Manifest V3 compliance. The extension's functionality is cosmetic, so the security risk is primarily related to the technical implementation rather than the core purpose.

Findings

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Content Security Policy:

script-src 'self' https://ajax.googleapis.com https://use.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; object-src 'self'

Embedded URLs (25 total):

https://github.com/carhartl/jquery-cookie	https://www.viz.com
https://bing.com/search?q=	https://www.viz.com/
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css	https://use.fontawesome.com/releases/v5.8.2/js/all.js
https://www.bing.com/	https://www.amazon.com
http://ebay.com	https://aliexpress.com
https://www.youtube.com/	https://www.facebook.com/
https://www.instagram.com/	https://twitter.com
https://www.viz.com//privacy-policy	https://www.viz.com/eula
https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js	https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js	https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js
https://clients2.google.com/service/update2/crx	https://ajax.googleapis.com
https://use.fontawesome.com	https://stackpath.bootstrapcdn.com
https://cdnjs.cloudflare.com

Raw Manifest

{
  "name": "__MSG_name__",
  "icons": {
    "48": "imgs/icon-48.png",
    "128": "imgs/icon-128.png"
  },
  "version": "0.0.1",
  "background": {
    "scripts": [
      "js/naruto-2020.js"
    ]
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "browser_action": {
    "default_icon": "imgs/icon-48.png"
  },
  "default_locale": "en",
  "offline_enabled": true,
  "manifest_version": 2,
  "chrome_url_overrides": {
    "newtab": "board.html"
  },
  "content_security_policy": "script-src 'self' https://ajax.googleapis.com https://use.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; object-src 'self'"
}

by ✦ Astarte