[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

WOT: Website Security & Safety Checker

Version 5.9.6 View in Chrome Web Store

Last scanned: about 11 hours ago

Extension Details

Developer: mywot.com

Rating: 4.5 ★ (10.8K ratings)

Users: 700,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

WOT (Web of Trust) is a well-established security company with a legitimate business model focused on website reputation and safety checking. The extension has 700,000 users and maintains a strong 4.5-star rating from over 10,000 reviews, indicating general user satisfaction. The company has been operating in the web security space for many years and has built a recognizable brand in website safety assessment.

Concerns:

The extension requires extensive permissions that, while necessary for its core functionality, create significant privacy implications. The combination of tabs, webNavigation, and webRequest permissions allows comprehensive monitoring of all browsing activity. The broad host permissions across all websites enable the extension to access and potentially collect data from every site visited. The webRequest permission is particularly concerning as it can intercept and modify web traffic, though this is likely used for safety checking rather than malicious purposes.

Recommendations:

Given the legitimate nature of WOT's business and the necessity of these permissions for website safety checking, the extension appears to be functioning as intended. However, users should understand that installing this extension means comprehensive browsing monitoring. Review WOT's privacy policy to understand data collection practices. Consider whether the security benefits outweigh the privacy trade-offs for your use case. If you're particularly privacy-conscious, you might prefer using WOT's website directly for occasional checks rather than continuous monitoring.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
contextMenus
webNavigation
webRequest
declarativeNetRequest
declarativeNetRequestFeedback
storage
scripting
alarms

Host Permissions:

http://www.mywot.com/*
http://api.mywot.com/*
https://api.mywot.com/*
http://*/*
https://*/*

Content Security Policy:

extension_pages: style-src 'self' 'unsafe-inline' http://fonts.googleapis.com; script-src 'self' ; object-src 'self'; img-src * data:;

Embedded URLs (107 total):

https://fonts.gstatic.com	https://fonts.googleapis.com/css2?family=Roboto:wght@400
https://npms.io/search?q=ponyfill.	https://cdn.growthbook.io
https://example.com	http://www.w3.org/2000/svg
https://fb.me/react-warning-keys	http://bit.ly/redux-logger-options
https://secure.mywot.com/domain/config	https://secure.mywot.com
https://secure.mywot.com/content/config	https://github.com/mixpanel/mixpanel-node
http://github.com/mixpanel/mixpanel-node.git	http://www.w3.org/TR/SVG11/feature#BasicStructure
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://scorecard.api.mywot.com	https://user.api.mywot.com
https://analytics.api.mywot.com	https://static.mywot.com/settings/extensions
https://app.mywot.com/api/analytics/sync	https://fonts.googleapis.com/css2?family=Montserrat:wght@500
https://chromewebstore.google.com/	https://microsoftedge.microsoft.com/addons
https://addons.mozilla.org	https://addons.opera.com
https://api.mywot.com/	https://score.mywot.com/scores
https://leak.api.mywot.com/scanEmails	https://www.google-analytics.com/mp/collect?
https://growthbook.mywot.com	https://auth.api.mywot.com
https://fonts.googleapis.com/css2?family=Montserrat:wght@400	https://sketchapp.com
http://www.bohemiancoding.com/sketch	https://cdn.jsdelivr.net/npm/@growthbook/growthbook@1.4.1/dist/bundles/index.js
https://bugs.chromium.org/p/v8/issues/detail?id=4118	https://bugs.chromium.org/p/v8/issues/detail?id=3056
http://fb.me/use-check-prop-types	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
https://fb.me/react-warning-dont-call-proptypes	http://fb.me/prop-types-in-prod
https://github.com/facebook/fbjs/blob/e66ba20ad5be433eb54423f2b097d829324d9de6/packages/fbjs/src/__forks__/warning.js	https://github.com/facebook/react/issues/3236
https://fb.me/react-special-props	https://reactjs.org/docs/react-api.html#createelement
https://reactjs.org/docs/react-api.html#createfactory	https://reactjs.org/docs/react-api.html#cloneelement
https://reactjs.org/docs/react-api.html#isvalidelement	https://reactjs.org/docs/react-api.html#reactchildrenforeach
https://reactjs.org/docs/react-api.html#reactchildrenmap	https://reactjs.org/docs/react-api.html#reactchildrencount
https://reactjs.org/docs/react-api.html#reactchildrentoarray	https://reactjs.org/docs/react-api.html#reactchildrenonly
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	http://facebook.github.io/react/docs/error-decoder.html?invariant=
https://cdn.jsdelivr.net/npm/webext-redux@4.0.0/dist/webext-redux.js	https://lodash.com/
https://jquery.org/	https://lodash.com/license
http://underscorejs.org/LICENSE	http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring
http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero	http://ecma-international.org/ecma-262/7.0/#sec-object.keys
http://ecma-international.org/ecma-262/7.0/#sec-tolength	http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types
https://github.com/reactjs/redux/blob/master/src/compose.js	http://fonts.googleapis.com
http://www.mywot.com/	http://api.mywot.com/
http://clients2.google.com/service/update2/crx	http://www.google.com/s2/favicons?domain=
https://leak.api.mywot.com	https://score.mywot.com
https://app.mywot.com	https://chrome.google.com/webstore/detail/idfjghemicebadpkihdooaaekecoiolg?hl
https://addons.mozilla.org/en-US/firefox/addon/wot-safe-browsing-tool/privacy/	https://test-79856.firebaseio.com/beta.json

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "images/16x16.png",
    "18": "images/18x18.png",
    "20": "images/20x20.png",
    "24": "images/24x24.png",
    "32": "images/32x32.png",
    "40": "images/40x40.png",
    "48": "images/48x48.png",
    "96": "images/96x96.png",
    "128": "images/128x128.png"
  },
  "action": {
    "default_icon": {
      "20": "images/20x20.png",
      "40": "images/40x40.png",
      "48": "images/48x48.png"
    },
    "default_popup": "",
    "default_title": "__MSG_appTooltip__"
  },
  "author": "MyWOT",
  "version": "5.9.6",
  "background": {
    "service_worker": "./background.js"
  },
  "short_name": "Web of Trust",
  "update_url": "http://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDescription__",
  "permissions": [
    "tabs",
    "contextMenus",
    "webNavigation",
    "webRequest",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "storage",
    "scripting",
    "alarms"
  ],
  "options_page": "options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "scripts/crossbrowser.js",
        "libs/lodash.min.js",
        "libs/react.min.js",
        "libs/react-dom.min.js",
        "libs/react-redux.min.js",
        "libs/webext-redux.js",
        "libs/react-custom-scrollbar.js",
        "libs/bodymovin-lottie-engine.js",
        "libs/growthbook.js",
        "scripts/shared/constants.js",
        "scripts/shared/fonts.js",
        "scripts/shared/utils.js",
        "scripts/shared/wotCrypto.js",
        "scripts/shared/wotApi.js",
        "scripts/shared/lottieAnimation.js",
        "scripts/shared/titleWithTooltip.js",
        "scripts/shared/growthbook.js",
        "scripts/background/app/actions.js",
        "scripts/content/components/common/warningReportsContainer.js",
        "scripts/content/components/common/ratingStars.js",
        "scripts/content/components/common/buttonAction.js",
        "scripts/content/components/common/reputationBubble.js",
        "scripts/content/components/assistant/preCheckAssistant.js",
        "scripts/content/components/assistant/popup.js",
        "scripts/content/components/assistant/assistantPopup.js",
        "scripts/content/components/shield/shield.js",
        "scripts/content/components/shield/shieldOnBoarding.js",
        "scripts/content/components/serpPopup/ScorecardData.js",
        "scripts/content/components/serpPopup/OptOutSerpPopup.js",
        "scripts/content/components/serpPopup/scorecardLink.js",
        "scripts/content/components/serpPopup/SerpPopupFooter.js",
        "scripts/content/components/serpWarning/serpWarning.js",
        "scripts/content/components/serpWarning/mailOffering.js",
        "scripts/shared/scheduler.js",
        "scripts/content/components/leakHook/leakHook.js",
        "scripts/content/components/idTheftHookInGmail/idTheftHookInGmail.js",
        "scripts/content/components/warning/warningAttributes.js",
        "scripts/content/components/warning/warningActionsContainer.js",
        "scripts/content/components/warning/warningMessageContainer.js",
        "scripts/content/components/warning/warningStrip.js",
        "scripts/content/components/warning/optoutStrip.js",
        "scripts/content/components/warning/badRatingNotification.js",
        "scripts/content/components/warning/warning.js",
        "scripts/content/addReviewHandler.js",
        "scripts/content/components/common/extendHandler.js",
        "scripts/content/components/common/previewHandler.js",
        "scripts/content/preCheckAssistantHandler.js",
        "scripts/content/serpHandler.js",
        "scripts/content/redirectHandler.js",
        "scripts/content/sharingHandler.js",
        "scripts/content/warningHandler.js",
        "scripts/content/leakHookHandler.js",
        "scripts/content/socialAuthHandler.js",
        "scripts/shared/getPremium.js",
        "scripts/shared/statelessFunctions.js",
        "scripts/shared/statelessFunctionsComponents.js",
        "scripts/content/popup/sliderManager.js",
        "scripts/content/popup/serpPopupManager.js",
        "scripts/content/index.js",
        "scripts/shared/pinWotPopup/pinPopupHandler.js",
        "scripts/shared/pinWotPopup/pinPopupContainer.js",
        "scripts/content/popupV2/popupOnboardingHandler.js",
        "scripts/content/popupV2/popupOnboarding.js",
        "scripts/content/popupV2/popupContentArea.js",
        "scripts/content/popupV2/popupMainContainer.js"
      ],
      "css": [
        "styles/content.css"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "scripts/content/extInfo.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.mywot.com/*"
      ],
      "all_frames": false
    },
    {
      "js": [
        "scripts/content/extInfoFrame.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "http://www.mywot.com/*",
    "http://api.mywot.com/*",
    "https://api.mywot.com/*",
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "style-src 'self' 'unsafe-inline' http://fonts.googleapis.com; script-src 'self' ; object-src 'self'; img-src * data:;"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "images/*.svg",
        "images/*.png",
        "images/*.gif",
        "styles/*.css",
        "scripts/content/*.js",
        "images/animations/*.json",
        "resources/*.json",
        "popupV2.html",
        "addReview.html",
        "loggedOut.html",
        "breachInfo.html"
      ],
      "extension_ids": []
    }
  ]
}

by ✦ Astarte

WOT: Website Security & Safety Checker

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (107 total):

Raw Manifest

Detections

Manifest Findings