CRX aminer
[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]
Extension icon

Moss

Version 0.5.9 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Rating: 4.8 ★ (272 ratings)
Users: 20,000

Context-Aware Verdict

CRITICAL
Overall Risk
Trust Factors:

The extension has a strong user rating of 4.8/5 from 272 reviews and 20,000 users, which suggests positive user experiences. However, the lack of visible developer information and company details reduces transparency and accountability. The extension appears to be associated with moss.site based on host permissions.

Concerns:

The extension exhibits several high-risk characteristics that justify the critical rating. The combination of identity permission with broad content script injection across all URLs creates significant privacy and security risks. The extension can access your Google identity information while simultaneously injecting scripts into every website you visit, potentially enabling credential theft or unauthorized account access. The tabs permission allows monitoring and manipulation of your browsing activity. The broad host permissions and universal content script injection capability means this extension has extensive access to sensitive data across all websites.

Recommendations:

Given the critical risk level, avoid installing this extension unless absolutely necessary. If you must use it, run it in a completely separate Chrome profile isolated from your main browsing activities and sensitive accounts. Never use this profile for banking, email, or other confidential activities. Regularly audit what data the extension might have accessed through your Google account settings. Consider whether the extension's functionality truly requires such extensive permissions, and look for alternative extensions with more limited scope if possible.

Findings

HIGH
Broad Content Script Injection
This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.
HIGH
Broad Host Permissions
This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.
HIGH
High-Risk Permission: identity
This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.
HIGH
High-Risk Permission: tabs
This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.
MEDIUM
Medium-Risk Permission: storage
This extension has the storage permission. Can store data locally.
by ✦ Astarte