Extension Details
Rating:
3.0 ★
(2 ratings)
Users:
1,000
Context-Aware Verdict
This section provides a Claude-based AI analysis that applies additional context to the risk. Results are not guaranteed to be accurate.
HIGH
Risk Level
Trust Factors: This extension has several concerning trust indicators. With only 1,000 users and a low 3.0 rating based on just 2 reviews, it lacks the user base and positive feedback that would indicate reliability. The absence of clear author and developer information raises additional red flags about accountability and transparency.
Concerns:
- Broad host permissions allowing access to all websites (http://*/* and https://*/*) are excessive for a typical authenticator app, which should only need to interact with specific authentication services
- The unsafe WebAssembly execution policy ('wasm-unsafe-eval') creates potential security vulnerabilities by allowing potentially malicious code execution
- Content scripts running on all websites could be used for data harvesting or malicious injection
- The combination of storage permissions with broad web access creates opportunities for sensitive data collection
- Low user adoption and poor ratings suggest potential quality or security issues
Recommendations:
Consider using established authenticator apps like Google Authenticator or Authy instead. If you must use this extension, run it in a completely separate Chrome profile isolated from your main browsing activities. Monitor your accounts closely for any suspicious activity. The broad permissions combined with unsafe execution policies and lack of developer transparency make this extension unsuitable for handling sensitive authentication data.
Security Analysis
This section provides a detailed analysis of the extension's security posture, without broader context. Assumes worst-case impact.
HIGH
Overall Risk
Based on 4 total findings, ranked without considering overall context, including 2 high-risk and 2 medium-risk findings.
HIGH
Broad Host Permissions
This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.
HIGH
Unsafe WebAssembly Execution
This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.
MEDIUM
Medium-Risk Permission: activeTab
This extension has the activeTab permission. Can access the active tab when clicking the extension icon.
MEDIUM
Medium-Risk Permission: storage
This extension has the storage permission. Can store data locally.
Security Analysis Details
Required Permissions:
- storage
- scripting
- activeTab
Host Permissions:
- http://*/*
- https://*/*
Content Security Policy:
- extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'
Embedded URLs (14 total):
| http://www.w3.org/2000/svg | http://www.w3.org/1998/Math/MathML | |
| http://www.w3.org/1999/xlink | https://pinia.vuejs.org/logo.svg | |
| https://pinia.vuejs.org | https://devtools.vuejs.org/guide/installation.html. | |
| https://pinia.vuejs.org/core-concepts/outside-component-usage.html | https://cli.vuejs.org/guide/webpack.html#modifying-options-of-a-loader | |
| https://github.com/vitejs/vite-plugin-vue/tree/main/packages/plugin-vue#example-for-passing-options-to-vuecompiler-sfc | https://authenticator-app.c-ext.com/ | |
| https://authenticator-app.c-ext.com/uninstall | https://clients2.google.com/service/update2/crx | |
| https://html2canvas.hertzen.com | https://hertzen.com |
Raw Manifest
{ "name": "__MSG_appName__", "icons": { "16": "icons/16.png", "24": "icons/24.png", "32": "icons/32.png", "48": "icons/48.png", "64": "icons/64.png", "96": "icons/96.png", "128": "icons/128.png" }, "action": { "default_popup": "popup.html" }, "version": "1.1.0", "background": { "type": "module", "service_worker": "background.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "__MSG_appDescription__", "permissions": [ "storage", "scripting", "activeTab" ], "default_locale": "en", "content_scripts": [ { "js": [ "content.js" ], "type": "module", "run_at": "document_end", "matches": [ "http://*/*", "https://*/*" ] } ], "host_permissions": [ "http://*/*", "https://*/*" ], "manifest_version": 3, "content_security_policy": { "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'" } }
Secure Annex (beta)
Coming soon...