[ new scan ] [ statistics ] [ github ] [ twitter ]

Starting analysis...

Meditate - Meditation anywhere

Version 3.2.8 View in Chrome Web Store

Last scanned: 14 days ago | force re-scan

Extension Details

Developer: rendom.net

Rating: 4.7 ★ (29 ratings)

Size: 7.0MiB

Last Updated: August 15, 2024

Users: 6,000

Developer Info: Rendomstr. 188, 3/1 Nur-sultan, Astana 010000 KZ

Context-Aware Verdict

LOW

Risk Level

Trust Factors:

- The extension has a relatively high rating of 4.7 stars from 29 reviews, indicating user satisfaction.

- The developer information is provided, lending some transparency.

- The extension's purpose (meditation) aligns with its requested permissions.

Concerns:

- The unlimitedStorage permission allows the extension to store an unlimited amount of data locally, which could potentially be misused for tracking or storing sensitive information.

Recommendations:

- While the permissions seem reasonable for a meditation app, it's advisable to exercise caution when granting unlimited storage access.

- Consider periodically reviewing and clearing the extension's stored data if you have privacy concerns.

- If you have doubts about the extension's trustworthiness, you can run it in a separate Chrome profile or incognito mode to isolate its access.

- Monitor for any suspicious behavior or performance issues that may indicate misuse of the granted permissions.

Overall, the extension appears to be low-risk based on the provided information, but it's always wise to remain vigilant and take necessary precautions to protect your privacy and security.

Security Analysis

MEDIUM

Overall Risk

Based on 2 total findings, ranked without considering overall context, including 0 high-risk and 2 medium-risk findings.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
unlimitedStorage

Optional Permissions:

alarms
notifications

Content Security Policy:

content_scripts: font-src 'self' data:; script-src 'self'; object-src 'self'; worker-src 'self'
extension_pages: font-src 'self' data:; script-src 'self'; object-src 'self'; worker-src 'self'

Embedded URLs (264 total):

https://clients2.google.com/service/update2/crx	https://img.youtube.com/vi/_RePlACe_/mqdefault.jpg
https://img.youtube.com/vi/_RePlACe_/hqdefault.jpg	https://www.npmjs.com/package/psl
http://www.apache.org/licenses/LICENSE-2.0	https://securetoken.google.com/
https://us-central1-taberium-backend.cloudfunctions.net/main/api	https://firebase.google.com/pricing/.
https://firebaseinstallations.googleapis.com/v1	https://fcmregistrations.googleapis.com/v1
https://taberium-backend.firebaseio.com	https://www.googleapis.com/calendar/v3/
https://accounts.google.com/o/oauth2/v2/auth?	https://www.googleapis.com/auth/calendar
https://www.googleapis.com/auth/tasks	https://focuso.app/api/google-oauth-redirect
https://www.googleapis.com/oauth2/v2/userinfo	https://tasks.googleapis.com/tasks/v1/
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?	https://focuso.app/api/oauth-redirect-microsoft
https://graph.microsoft.com/v1.0/me/	https://graph.microsoft.com/Tasks.ReadWrite
https://graph.microsoft.com/v1.0/me/todo/	https://www.episodate.com/user/calendar?id=
https://calendar.google.com/calendar/render?action=TEMPLATE	https://www.google.com/search?q=
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://chat.openai.com
https://chat.openai.com/api/auth/session	https://api.openai.com/v1/images/generations
https://api.openai.com/v1/chat/completions	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/	http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
https://www.youtube.com/watch	https://vimeo.com/
https://www.dailymotion.com/	https://www.twitch.tv/
https://www.facebook.com/watch/?v=	https://www.instagram.com/p/
https://www.tiktok.com/@user/video/	https://www.linkedin.com/posts/activity-
https://www.vk.com	https://www.amazon.com
https://www.ebay.com/itm	https://www.walmart.com
https://www.alibaba.com	https://www.etsy.com
https://www.target.com	https://www.bestbuy.com
https://www.shopify.com	https://www.rakuten.com
https://www.jd.com	https://www.aliexpress.com
https://avito.ru	https://www.ozon.ru
https://www.lamoda.ru	https://www.wildberries.ru
https://www.eldorado.ru	https://www.olx.com/d/
https://www.rozetka.com.ua	https://www.taobao.com
https://github.com	https://gitlab.com
https://bitbucket.org	https://stackoverflow.com
https://www.npmjs.com	https://yarnpkg.com
https://www.docker.com	https://kubernetes.io
https://www.ansible.com	https://terraform.io
https://www.linux.org	https://www.apache.org
https://www.nginx.com	https://www.mysql.com

Page 1 of 4

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzrZd9Pd0KRt8S5N9dJJu9Jy+JjFYkMZq4kJ0vumAILzNm4GiXxRL6IJTMjpX/0pepvxMdz7IyCLs21XGac0SRtDqwqbzYnt8w8sVkIqcGSq37NS4o4FkzqF0PBuMMIrOtSW4XdkiZiDRLkZ9JHwBwoBJ/P2tMR14IY5ewjSVg5bTQpQNEtWYkJgfsGoUtCL0KyWk7jUs07OCGG/C8DkgUseJKoBia9z04zdeqcFJIXLlA/JKegvSQUOauPvYOYOAG0IJwvRmyuMyhj2wAUC5cAUVgPtNqj0rIoQAXIHQYv4S9aXvwOeLDtJWDX9hzeNbdJ9QM6Aj99wPnHTGZ6hShQIDAQAB",
  "name": "__MSG_appName__",
  "icons": {
    "16": "assets/apps/meditate/icon_128.png",
    "32": "assets/apps/meditate/icon_128.png",
    "48": "assets/apps/meditate/icon_128.png",
    "128": "assets/apps/meditate/icon_128.png"
  },
  "action": {
    "default_icon": {
      "16": "assets/apps/meditate/icon_128.png",
      "32": "assets/apps/meditate/icon_128.png",
      "48": "assets/apps/meditate/icon_128.png",
      "128": "assets/apps/meditate/icon_128.png"
    }
  },
  "version": "3.2.8",
  "commands": {},
  "background": {
    "type": "module",
    "service_worker": "service-worker-loader.js"
  },
  "short_name": "__MSG_appShortName__",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "storage",
    "unlimitedStorage"
  ],
  "default_locale": "en",
  "host_permissions": [],
  "manifest_version": 3,
  "optional_permissions": [
    "alarms",
    "notifications"
  ],
  "content_security_policy": {
    "content_scripts": "font-src 'self' data:; script-src 'self'; object-src 'self'; worker-src 'self'",
    "extension_pages": "font-src 'self' data:; script-src 'self'; object-src 'self'; worker-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "_favicon/*",
        "assets/sounds/*",
        "assets/**",
        "localization/*",
        "contentScript/*",
        "*"
      ],
      "use_dynamic_url": false
    }
  ],
  "optional_host_permissions": []
}

Meditate - Meditation anywhere

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Optional Permissions:

Content Security Policy:

Embedded URLs (264 total):

Raw Manifest

Secure Annex (beta)