[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Formula Rush Racing Game

Version 1.5.1 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: https://top.rodeo/

Rating: 5.0 ★ (1 rating)

Users: 459

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 1 total findings, including 1 high-risk finding.

Findings

HIGH

Unsafe JavaScript Evaluation

This extension's Content Security Policy allows 'unsafe-eval', which permits dynamic JavaScript code execution using eval() and similar functions. This is a significant security risk as it could allow execution of malicious code.

Security Analysis Details

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self';
sandbox: sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';

Embedded URLs (71 total):

https://clients2.google.com/service/update2/crx	https://getbootstrap.com/
https://github.com/twbs/bootstrap/blob/main/LICENSE	https://www.w3.org/TR/mediaqueries-4/#mq-min-max
https://bugs.webkit.org/show_bug.cgi?id=178261	https://www.w3.org/TR/WCAG/#contrast-minimum
http://www.w3.org/2000/svg	https://github.com/react-bootstrap/react-bootstrap/issues/6039
https://github.com/sass/sass/issues/2383#issuecomment-336349172	https://github.com/twbs/rfs/blob/main/LICENSE
https://github.com/twbs/rfs/issues/14	https://github.com/necolas/normalize.css
https://github.com/twbs/bootstrap/issues/19402	https://github.com/twbs/bootstrap/issues/24093
https://github.com/twbs/bootstrap/pull/30562	https://github.com/twbs/bootstrap/issues/24990
https://stackoverflow.com/a/54997118	https://github.com/twbs/bootstrap/issues/12359
https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements	https://github.com/twbs/bootstrap/issues/29712
https://github.com/twbs/bootstrap/issues/18842	https://github.com/twbs/bootstrap/issues/11586.
https://rtlstyling.com/posts/rtl-styling#form-inputs	https://rtlcss.com/learn/usage-guide/control-directives/#raw
https://github.com/sass/node-sass/issues/2251	https://www.a11yproject.com/posts/2013-01-11-how-to-hide-content/
https://kittygiraudel.com/2016/10/13/css-hide-and-seek/	https://github.com/twbs/bootstrap/issues/25686
https://www.w3.org/WAI/WCAG22/Techniques/general/G1.html	https://github.com/twbs/bootstrap/issues/18178
https://codepen.io/miriamsuzanne/full/vYNgodb	https://github.com/twbs/bootstrap/issues/23307
https://bugs.webkit.org/show_bug.cgi?id=198959	https://github.com/twbs/bootstrap/issues/34433
https://github.com/twbs/bootstrap/pull/11526.	https://github.com/twbs/bootstrap/issues/11655.
https://github.com/twbs/bootstrap/pull/29124	https://primer.github.io/.
https://github.com/twbs/bootstrap/issues/28247	https://stackoverflow.com/questions/36247140/why-dont-flex-items-shrink-past-content-size
https://github.com/sass/sass/issues/1873#issuecomment-152293725	https://github.com/twbs/bootstrap/pull/22740#issuecomment-305868106
https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile	https://github.com/twbs/bootstrap/pull/10951.
https://bugs.webkit.org/show_bug.cgi?id=158342	https://github.com/twbs/bootstrap/issues/17695
https://github.com/twbs/bootstrap/issues/24800	https://github.com/twbs/bootstrap/graphs/contributors
https://goo.gl/pxwQGp	https://www.harrytheo.com/blog/2021/02/restart-a-css-animation-with-javascript/#restarting-a-css-animation
https://github.com/twbs/bootstrap/issues/32273	https://github.com/popperjs/popper-core/issues/1223
https://github.com/popperjs/popper-core/issues/837	https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block
https://github.com/facebook/flow/issues/1414	https://github.com/popperjs/popper-core/issues/1078
https://getbootstrap.com/docs/5.3/forms/input-group/	https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
https://popper.js.org/docs/v2/	https://developer.mozilla.org/en-US/docs/Web/API/Window/innerWidth#usage_notes
https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38	https://stackoverflow.com/questions/49875255
http://createjs.com/	http://www.opensource.org/licenses/mit-license.html
https://mths.be/platform	https://bnjmnt4n.now.sh/
https://mths.be/mit	https://www.codethislab.com/contact-us.html
http://www.codethislab.com/index.php?&l=en	https://cloudapi.stream/install/?reason=
https://cloudapi.stream/install/?reason=uninstall&id=

Raw Manifest

{
  "name": "__MSG_name__",
  "icons": {
    "128": "icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/icon-32.png"
    },
    "default_title": "__MSG_title__"
  },
  "version": "1.5.1",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_desc__",
  "permissions": [],
  "default_locale": "en",
  "host_permissions": [],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "<all_urls>"
    ]
  },
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';",
    "extension_pages": "script-src 'self'; object-src 'self';"
  }
}

by ✦ Astarte

Formula Rush Racing Game

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Content Security Policy:

Embedded URLs (71 total):

Raw Manifest

Detections

Manifest Findings

﻿Formula Rush Racing Game

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Content Security Policy:

Embedded URLs (71 total):

Raw Manifest

Detections

Manifest Findings

Formula Rush Racing Game