[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Sendr - Hyper-personalized outreach at scale

Version 1.1.5 View in Chrome Web Store

Last scanned: about 18 hours ago

Extension Details

Developer: Intro Labs LTD

Rating: 4.8 ★ (6 ratings)

Users: 1,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension has a very small user base of only 1,000 users and just 6 reviews, making it difficult to assess reliability through community feedback. While it maintains a high 4.8-star rating, the limited sample size reduces confidence in this metric. The developer, Intro Labs LTD, lacks established reputation indicators in the extension ecosystem.

Concerns: This extension exhibits extremely broad access capabilities that far exceed what would be necessary for typical outreach automation. The combination of cookies permission with universal host access creates significant privacy risks, as it can read and modify authentication data across all websites. The ability to inject content scripts into every website visited, coupled with tab manipulation permissions, creates potential for credential harvesting, session hijacking, and unauthorized data collection. The broad permissions suggest the extension could monitor all browsing activity and potentially exfiltrate sensitive business communications or personal data.

Recommendations: Given the critical risk level, avoid installing this extension on your primary browser profile. If the functionality is essential for your business, create an isolated Chrome profile specifically for this extension and limit its use to only necessary websites. Consider alternative outreach tools with more restrictive permissions. Regularly audit what data the extension might be accessing and ensure your organization's security policies permit such broad access tools. Monitor for any unusual network activity or unauthorized account access after installation.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

cookies
storage
activeTab
tabs
scripting

Host Permissions:

<all_urls>

Embedded URLs (173 total):

http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://github.com/facebook/regenerator/blob/main/LICENSE	https://app.sendr.io
https://api.sendr.io	https://staging-app.sendr.io
https://staging-api.sendr.io	https://api.mux.com
https://api.mux.com/video/v1/assets/	https://stream.mux.com/
https://fonts.googleapis.com/css2?family=Rethink+Sans:wght@100	https://github.com/muaz-khan/RecordRTC
https://github.com/muaz-khan/RecordRTC/blob/master/LICENSE	https://MuazKhan.com
https://github.com/muaz-khan/RecordRTC/tree/master/MRecordRTC	https://www.webrtc-experiment.com/EBML.js
https://w3c.github.io/mediacapture-record/MediaRecorder.html	https://github.com/muaz-khan
https://www.webrtc-experiment.com/screenshot.js	https://github.com/antimatter15
https://unpkg.com/webm-wasm@latest/dist/webm-worker.js	https://unpkg.com/webm-wasm@latest/dist/webm-wasm.wasm
https://unpkg.com/@mattiasbuelens/web-streams-polyfill/dist/polyfill.min.js	https://github.com/muaz-khan/RecordRTC/blob/master/simple-demos/RecordRTCPromisesHandler.html
https://aomedia.org/emsg/ID3	http://www.w3.org/ns/ttml#styling
https://fonts.googleapis.com	https://fonts.gstatic.com
https://gist.github.com/paulirish/1579671	http://goo.gl/B3ae8c
https://github.com/cheton/is-electron/blob/master/index.js	https://github.com/legokichi/ts-ebml
http://goo.gl/xmE5eg	https://w3c.github.io/mediacapture-record/MediaRecorder.html#exception-summary
http://typedarray.org/wp-content/projects/WebAudioRecorder/script.js	https://github.com/mattdiamond/Recorderjs#license-mit
http://stackoverflow.com/a/28977136/552182	http://stackoverflow.com/a/26303918/552182
https://github.com/muaz-khan/WebRTC-Experiment/pull/316	https://github.com/antimatter15/whammy/blob/master/LICENSE
https://github.com/muaz-khan/MultiStreamsMixer	https://app.sendr.io/
https://clients2.google.com/service/update2/crx	http://www.w3.org/XML/1998/namespace
https://reactjs.org/link/controlled-components	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	https://reactjs.org/link/dangerously-set-inner-html
https://reactjs.org/link/invalid-aria-props	https://reactjs.org/link/attribute-behavior
https://reactjs.org/link/crossorigin-error	https://reactjs.org/link/unsafe-component-lifecycles
https://reactjs.org/link/derived-state	https://reactjs.org/link/legacy-context
https://reactjs.org/link/strict-mode-string-ref	https://reactjs.org/link/refs-must-have-owner
https://reactjs.org/link/warning-keys	https://reactjs.org/link/rules-of-hooks
https://reactjs.org/link/invalid-hook-call	https://reactjs.org/link/error-boundaries
https://reactjs.org/link/hooks-data-fetching	https://reactjs.org/link/setstate-in-render
https://reactjs.org/link/wrap-tests-with-act	https://reactjs.org/link/react-polyfills
https://reactjs.org/link/react-devtools	https://reactjs.org/link/react-devtools-faq
https://reactjs.org/link/strict-mode-find-node	https://reactjs.org/link/switch-to-createroot
https://github.com/facebook/react/issues/3236	https://reactjs.org/link/special-props
https://github.com/facebook/react/issues	https://github.com/facebook/react/issues/13610
https://github.com/facebook/react/issues/11347	https://github.com/facebook/react/pull/22064.
https://url.spec.whatwg.org/#url-parsing	https://infra.spec.whatwg.org/#ascii-tab-or-newline
https://infra.spec.whatwg.org/#c0-control-or-space	https://github.com/facebook/react/issues/19099
https://github.com/facebook/react/issues/11768	http://www.w3.org/TR/2012/WD-html5-20121025/the-input-element.html

Page 1 of 3

Raw Manifest

{
  "name": "Sendr - Hyper-personalized outreach at scale",
  "icons": {
    "16": "assets/img/Sendr Logo 16.png",
    "32": "assets/img/Sendr Logo 32.png",
    "48": "assets/img/Sendr Logo 48.png",
    "128": "assets/img/Sendr Logo 128.png"
  },
  "action": {
    "default_icon": "assets/img/Sendr Logo 128.png",
    "default_popup": "popup.html"
  },
  "version": "1.1.5",
  "background": {
    "service_worker": "background.bundle.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Create hyper-personalised outreach and fully custom landing pages with Sendr.",
  "permissions": [
    "cookies",
    "storage",
    "activeTab",
    "tabs",
    "scripting"
  ],
  "content_scripts": [
    {
      "js": [
        "contentScript.bundle.js"
      ],
      "css": [
        "content.styles.css"
      ],
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ]
    },
    {
      "js": [
        "hubspot.js",
        "contentScript.bundle.js"
      ],
      "css": [
        "content.styles.css"
      ],
      "matches": [
        "https://*.hubspot.com/*"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "popup.html",
        "content.styles.css",
        "assets/img/icon-128.png",
        "assets/img/icon-34.png",
        "assets/img/*",
        "a5395cd2cb961c29ed99.svg",
        "d6e5724b803be0041f59.svg",
        "9ba2f0d72d3b69f91f46.svg",
        "833beb021ea917efa189.svg",
        "1fe4e9e758d5d670d821.svg",
        "1b38744f503674234624.svg",
        "5bb9782d71508c7eb6bc.svg",
        "182382fd5e7a98be7170.png",
        "d6f747ab133d60ac702f.png",
        "d08252b84a042e4011e4.png",
        "7d0f979cfe7aa40c0dc2.svg",
        "7527b1ee0863676ff2e3.png",
        "assets/img/copygif.svg",
        "assets/img/link.svg"
      ]
    }
  ]
}

by ✦ Astarte

Sendr - Hyper-personalized outreach at scale

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (173 total):

Raw Manifest

Detections

Manifest Findings