[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

RingCentral App Connect - BETA

Version 1.7.10 View in Chrome Web Store

Last scanned: about 8 hours ago

Extension Details

Rating: 3.0 ★ (1 rating)

Users: 221

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has very limited adoption with only 221 users and a single 3.0-star rating, indicating minimal community validation. The BETA designation suggests it's still in development and may contain bugs or incomplete security measures. The lack of detailed developer information and company reputation data raises additional concerns about accountability and trustworthiness.

Concerns:

The extension's broad content script injection capability across all URLs is particularly concerning for a business communication tool, as it could access sensitive data on any website. The unsafe WebAssembly execution policy creates potential for hidden malicious code. The tabs permission allows extensive browser manipulation beyond what would typically be necessary for a RingCentral integration. The combination of unlimited storage with broad web access could enable large-scale data collection and exfiltration.

Recommendations:

Given the high risk profile, install this extension only in a separate Chrome profile dedicated to RingCentral usage. Avoid using this profile for sensitive activities like banking or accessing confidential business systems. Monitor the extension's behavior closely and consider whether the BETA functionality is essential enough to justify the security risks. Wait for a stable release with better security practices if possible, or explore alternative RingCentral integration methods that don't require such broad permissions.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
alarms
tabs
background
unlimitedStorage
notifications

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self' 'wasm-unsafe-eval'

Embedded URLs (1227 total):

http://www.w3.org/2000/svg	https://rc-hack-c2d.detect
http://www.opensource.org/licenses/mit-license.php	http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring
https://css-tricks.com/debouncing-throttling-explained-examples/	http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind	https://github.com/fantasyland/fantasy-land#chain
https://github.com/fantasyland/fantasy-land#semigroup	https://github.com/fantasyland/fantasy-land#monoid
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach#Description	https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/Object/assign
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString
https://github.com/fantasyland/fantasy-land#apply	https://github.com/fantasyland/fantasy-land#functor
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/match	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/of
https://github.com/fantasyland/fantasy-land#profunctor	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/reduce#Description
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/reduceRight#Description	https://github.com/fantasyland/fantasy-land#traversable
https://github.com/fantasyland/fantasy-land#applicative	https://developer.mozilla.org/en-US/docs/Web/API/Node/isConnected
https://developer.mozilla.org/en-US/docs/Web/API/Text/splitText	http://jedwatson.github.io/classnames
https://tc39.es/ecma262/#sec-array.prototype-@@unscopables	https://tc39.es/ecma262/#sec-advancestringindex
https://tc39.es/ecma262/#sec-array.prototype.includes	https://tc39.es/ecma262/#sec-array.prototype.indexof
https://github.com/zloirock/core-js/issues/677	https://tc39.es/ecma262/#sec-arrayspeciescreate
https://github.com/zloirock/core-js/issues/306	https://github.com/zloirock/core-js/issues/1128
https://github.com/zloirock/core-js/issues/1130	https://tc39.es/ecma262/#sec-getmethod
https://tc39.es/ecma262/#sec-getsubstitution	https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
https://tc39.es/ecma262/#sec-hasownproperty	https://github.com/mozilla/rhino/issues/346
https://tc39.es/ecma262/#sec-isarray	https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
https://tc39.es/ecma262/#sec-iscallable	https://tc39.es/ecma262/#sec-isconstructor
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot-aec	https://tc39.es/ecma262/#sec-isregexp
https://tc39.es/ecma262/#sec-lengthofarraylike	https://tc39.es/ecma262/#sec-math.trunc
https://github.com/zloirock/core-js/issues/475	https://github.com/es-shims/es5-shim/issues/150
https://github.com/kitcambridge/es5-shim/commit/4f738ac066346	https://tc39.es/ecma262/#sec-object.create
https://tc39.es/ecma262/#sec-object.defineproperties	https://tc39.es/ecma262/#sec-object.defineproperty
https://tc39.es/ecma262/#sec-object.getownpropertydescriptor	https://tc39.es/ecma262/#sec-object.getownpropertynames
https://tc39.es/ecma262/#sec-object.keys	https://tc39.es/ecma262/#sec-object.prototype.propertyisenumerable
https://tc39.es/ecma262/#sec-object.setprototypeof	https://tc39.es/ecma262/#sec-object.prototype.tostring
https://tc39.es/ecma262/#sec-ordinarytoprimitive	https://tc39.es/ecma262/#sec-regexpexec
https://tc39.es/ecma262/#sec-get-regexp.prototype.flags	https://github.com/zloirock/core-js/issues/1008
https://bugzilla.mozilla.org/show_bug.cgi?id=773687	https://tc39.es/ecma262/#sec-requireobjectcoercible
https://github.com/zloirock/core-js/blob/v3.37.0/LICENSE	https://github.com/zloirock/core-js
https://tc39.es/ecma262/#sec-speciesconstructor	https://tc39.es/ecma262/#sec-string.prototype.codepointat
https://github.com/mathiasbynens/String.prototype.at	https://tc39.es/ecma262/#sec-tointegerorinfinity
https://tc39.es/ecma262/#sec-tolength	https://tc39.es/ecma262/#sec-toobject
https://tc39.es/ecma262/#sec-toprimitive	https://tc39.es/ecma262/#sec-topropertykey
https://bugs.chromium.org/p/v8/issues/detail?id=3334	https://github.com/zloirock/core-js/issues/679
https://tc39.es/ecma262/#sec-array.prototype.concat	https://tc39.es/ecma262/#sec-array.isarray

Page 1 of 16

Raw Manifest

{
  "name": "RingCentral App Connect - BETA",
  "icons": {
    "16": "images/logo16.png",
    "32": "images/logo32.png",
    "48": "images/logo48.png",
    "128": "images/logo128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/logo16.png",
      "32": "images/logo32.png",
      "48": "images/logo48.png",
      "128": "images/logo128.png"
    }
  },
  "version": "1.7.10",
  "background": {
    "service_worker": "sw.js"
  },
  "options_ui": {
    "page": "options.html",
    "open_in_tab": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "A RingCentral extension for CRM platforms",
  "permissions": [
    "storage",
    "alarms",
    "tabs",
    "background",
    "unlimitedStorage",
    "notifications"
  ],
  "content_scripts": [
    {
      "js": [
        "./c2d/index.js",
        "./content.js"
      ],
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://appconnect.labs.ringcentral.com/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self' 'wasm-unsafe-eval'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "/embeddable/*",
        "/c2d/*"
      ]
    }
  ]
}

by ✦ Astarte

RingCentral App Connect - BETA

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (1227 total):

Raw Manifest

Detections

Manifest Findings