[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Read on reMarkable

Version 2.2.1 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Rating: 3.3 ★ (137 ratings)

Users: 300,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
scripting
storage
contextMenus
printerProvider

Host Permissions:

http://*/*
https://*/*

Embedded URLs (536 total):

https://github.com/wxt-dev/wxt/issues/371	https://wxt.dev/guide/go-further/testing.html
https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin	https://internal.cloud.remarkable.com
https://auth.remarkable.com	https://my.remarkable.com
https://992ad278b25013d58cc625385119cc1b@o100763.ingest.us.sentry.io/4510323218579457	https://ror-tracking-api.store-services-prod.remarkable.com/api/marker
https://webapp-prod.cloud.remarkable.engineering	https://web.cloud.remarkable.com
https://support.remarkable.com/survey/runtimeApp.app?invitationId=0KiQD00000DolvV&surveyName=software_read_on_remarkable_survey&UUID=ef8483e6-bd4d-4fa4-bc4c-8ff56c71f7ee	https://auth.remarkable.com/tectonic
https://auth.remarkable.com/subscription	http://www.w3.org/2000/svg
https://sentry.io/welcome/	https://feross.org/opensource
https://feross.org	https://wxt.dev/storage.html
https://auth0.com/docs/tokens/guides/create-namespaced-custom-claims	https://faisalman.github.io/ua-parser-js
https://github.com/faisalman/ua-parser-js	https://github.com/getsentry/sentry-javascript/issues/2286
https://github.com/getsentry/sentry-javascript/issues/5459	https://github.com/getsentry/sentry-javascript/issues/7813
https://github.com/getsentry/sentry/blob/master/src/sentry/lang/javascript/processor.py#L67	https://github.com/getsentry/sentry-javascript/pull/8981
https://github.com/getsentry/sentry-javascript/issues/8935	http://stackoverflow.com/questions/105034/how-to-create-a-guid-uuid-in-javascript/2117523#2117523
https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string	https://developer.mozilla.org/en-US/docs/Web/API/Performance
https://github.com/getsentry/sentry-javascript/issues/2590	https://github.com/mdn/content/issues/4713
https://dev.to/noamr/when-a-millisecond-is-not-a-millisecond-3h6	https://github.com/getsentry/sentry-javascript/issues/2590.
https://caniuse.com/mdn-api_performance_timeorigin	https://develop.sentry.dev/sdk/telemetry/traces/span-links/#link-types
https://opentelemetry.io/docs/specs/semconv/gen-ai/	https://develop.sentry.dev/sdk/event-payloads/span/
https://www.w3.org/TR/baggage/#limits	https://develop.sentry.dev/sdk/telemetry/traces/tracing-without-performance/
https://github.com/getsentry/sentry-javascript/issues/2572.	https://develop.sentry.dev/sdk/telemetry/scopes/#setting-attributes
https://github.com/getsentry/sentry-javascript/pull/18165	https://developer.mozilla.org/en-US/docs/Web/API/Headers/get
https://develop.sentry.dev/sdk/expected-features/#dealing-with-network-failures	https://www.rfc-editor.org/rfc/rfc2557.html
https://develop.sentry.dev/sdk/data-handling/#structuring-data	https://opentelemetry.io/docs/specs/semconv/http/.
https://opentelemetry.io/docs/specs/semconv/http/http-spans/#name	https://tools.ietf.org/html/rfc3986#appendix-B
https://github.com/getsentry/sentry-javascript/pull/7404	https://github.com/getsentry/sentry-javascript/pull/4196
https://issuetracker.google.com/issues/396043331	https://developers.facebook.com/community/threads/320013549791141/
https://github.com/getsentry/sentry-javascript/issues/15065	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/AggregateError
https://caniuse.com/#feat=referrer-policy	https://github.com/getsentry/raven-js/issues/1233
https://stackoverflow.com/a/58879212	https://stackoverflow.com/a/3540295
https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getDisplayMedia	https://forums.developer.apple.com/forums/thread/119186
https://stackoverflow.com/questions/60482650/how-to-detect-ipad-useragent-on-safari-browser	https://stackoverflow.com/q/75833049
https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getDisplayMedia#prefercurrenttab	https://github.com/getsentry/sentry-javascript/issues/1168
https://github.com/getsentry/sentry/blob/9f08305e09866c8bd6d0c24f5b0aabdd7dd6c59c/src/sentry/lang/javascript/errormapping.py#L83-L108	https://github.com/zertosh/invariant/blob/master/invariant.js#L46
https://developer.mozilla.org/en-US/docs/WebAssembly/JavaScript_interface/Exception	https://github.com/getsentry/sentry-javascript/issues/13787
https://github.com/getsentry/sentry-javascript/issues/1949	https://developer.mozilla.org/en-US/docs/Web/API/DOMError
https://developer.mozilla.org/en-US/docs/Web/API/DOMException	https://webidl.spec.whatwg.org/#es-DOMException-specialness
https://github.com/getsentry/sentry-javascript/issues/838	https://developer.mozilla.org/en-US/docs/Web/API/History/pushState#url
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/open#url	https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
https://github.com/getsentry/sentry-javascript/pull/7553	https://github.com/getsentry/sentry-javascript/issues/6880

Page 1 of 7

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjWk+CwR9NsqLrWundKWYKAShdQIWffaUQccaFVMnkwpe3bBNB3+CiquZOxiwJhY7wOljG82s59cAPg/fKpUUXfkaDYNcAOPJ4WjoeIa/mUpRkYAJucE4xRS4GwR6DBreWCo015MxXC34QRQb9lppoWf5uY6wB0AxnFzZWQw4N2xwyg/FTeQ0SGymN5LUpPylYgm+BXFeqLR6bAT/FmoZ9I3TZUsQ8Ieg0BIpqeWIgBiWXU8gETRiWNV+C/UE12OzsTmcwr7uCiN8z3Go4M1Sq+PilYSbr1hlNehYvpgG/p3ZCtHWfId3jzng9aFV3jo4xbyP3WSDxmfL0at/YAY49QIDAQAB",
  "name": "Read on reMarkable",
  "icons": {
    "16": "icon/16.png",
    "32": "icon/32.png",
    "48": "icon/48.png",
    "96": "icon/96.png",
    "144": "icon/144.png",
    "256": "icon/256.png"
  },
  "action": {
    "default_popup": "popup.html",
    "default_title": "Read on Remarkable"
  },
  "version": "2.2.1",
  "background": {
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Easily send web articles to your reMarkable with one click.",
  "permissions": [
    "activeTab",
    "scripting",
    "storage",
    "contextMenus",
    "printerProvider"
  ],
  "content_scripts": [
    {
      "js": [
        "content-scripts/content.js"
      ],
      "matches": [
        "*://*/*"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "callback.html",
        "options.html",
        "reMarkableSans-Variable.woff2",
        "reMarkableSerif-Variable.woff2"
      ]
    }
  ]
}

by ✦ Astarte

Read on reMarkable

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (536 total):

Raw Manifest

Detections

Manifest Findings