[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Change Colors

Version 2.244 View in Chrome Web Store

Last scanned: about 6 hours ago

Extension Details

Rating: 4.0 ★ (50 ratings)

Users: 6,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has a modest user base of 6,000 users with a decent 4.0-star rating from 50 reviews, which provides some community validation. However, the lack of developer information and missing last updated date raises transparency concerns. The simple name "Change Colors" suggests a straightforward utility function, but the extensive permissions don't align with this basic purpose.

Concerns:

The extension requests extremely broad permissions that far exceed what would be necessary for a color-changing tool. The combination of tabs, webNavigation, and all_urls permissions creates a surveillance capability that could track your entire browsing activity across all websites. The content script injection on all URLs means this extension can read and modify any webpage you visit, potentially capturing passwords, personal information, or financial data. The use of Manifest V2 indicates outdated security standards, making it more vulnerable to exploitation.

Recommendations:

Do not install this extension due to its critical risk level. If color customization is needed, look for alternatives with minimal permissions that only request access to specific sites or use activeTab permission. If you must use this extension, run it in a completely separate Chrome profile isolated from your main browsing activities, banking, or any sensitive accounts. Consider browser-native accessibility features or well-established extensions from verified developers instead.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Raw Manifest

{
  "name": "Change Colors",
  "icons": {
    "16": "icons/colors_icons.png",
    "32": "icons/colors_icons.png",
    "48": "icons/colors_icons.png",
    "128": "icons/colors_icons.png"
  },
  "version": "2.244",
  "background": {
    "scripts": [
      "background_page.js"
    ],
    "persistent": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Change pages styling according to the user's preferences.",
  "page_action": {
    "default_icon": "icons/colors_icons.png",
    "default_popup": "popup.html",
    "default_title": "Change Colors"
  },
  "permissions": [
    "tabs",
    "webNavigation",
    "http://*/*",
    "https://*/*",
    "<all_urls>"
  ],
  "options_page": "options.html",
  "content_scripts": [
    {
      "js": [
        "convert.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "manifest_version": 2,
  "minimum_chrome_version": "33.0"
}

by ✦ Astarte

https://github.com/Strav/Change-Colors	http://www.openjs.com/scripts/events/keyboard_shortcuts/
http://www.lalit.org/lab/jsoncookies	http://creativecommons.org/licenses/by-sa/2.5/
http://www.gnu.org/copyleft/lesser.html	http://odvarko.cz
http://jscolor.com	https://clients2.google.com/service/update2/crx
http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd	http://www.w3.org/1999/xhtml

Change Colors

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (10 total):

Raw Manifest

Detections

Manifest Findings