[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Armis Centrix

Version 1.2.0 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Rating: 5.0 ★

Users: 229

Context-Aware Verdict

HIGH

Overall Risk

Based on 6 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
contextMenus
cookies
declarativeNetRequest
scripting
sidePanel
storage

Host Permissions:

https://*.armis.com/

Embedded URLs (138 total):

https://esbench.com/bench/5bfee68a4cd7e6009ef61d23	https://github.com/facebook/react/issues/13610
https://github.com/facebook/react/issues/11347	https://github.com/facebook/react/pull/22064.
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://url.spec.whatwg.org/#url-parsing	https://infra.spec.whatwg.org/#ascii-tab-or-newline
https://infra.spec.whatwg.org/#c0-control-or-space	https://github.com/facebook/react/issues/19099
https://github.com/facebook/react/issues/11768	http://www.w3.org/TR/2012/WD-html5-20121025/the-input-element.html
https://reactjs.org/link/controlled-components	https://bugs.chromium.org/p/chromium/issues/detail?id=608416
https://github.com/facebook/react/issues/7253	https://developer.microsoft.com/microsoft-edge/platform/issues/101525/
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	https://github.com/mozilla/gecko-dev/blob/4e638efc71/layout/style/test/property_database.js
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet	http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/
http://modernizr.com/docs/#prefixed	http://www.andismith.com/blog/2012/02/modernizr-prefixed/
https://reactjs.org/link/dangerously-set-inner-html	https://w3c.github.io/webcomponents/spec/custom/#custom-elements-core-concepts
https://reactjs.org/link/invalid-aria-props	https://reactjs.org/link/attribute-behavior
https://github.com/facebook/react/issues/12506	http://www.quirksmode.org/js/events_properties.html
https://github.com/facebook/react/issues/1698	https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener#Safely_detecting_option_support
https://github.com/facebook/create-react-app/issues/3482	https://github.com/facebook/react/issues/13688
https://reactjs.org/link/crossorigin-error	https://github.com/facebook/react/issues/16734
https://github.com/facebook/react/issues/16585	https://github.com/facebook/react/issues/3877
https://reactjs.org/link/react-devtools	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/clz32
https://v8.dev/blog/elements-kinds#avoid-creating-holes	http://www.w3.org/TR/DOM-Level-3-Events/
http://www.w3.org/TR/css3-animations/#AnimationEvent-interface	https://developer.mozilla.org/en-US/docs/Web/API/AnimationEvent
http://www.w3.org/TR/clipboard-apis/	http://www.w3.org/TR/DOM-Level-3-Events/#events-compositionevents
http://www.w3.org/TR/2013/WD-DOM-Level-3-Events-20131105	https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent#Key_names
http://www.w3.org/TR/DOM-Level-3-Events/#keys-Modifiers	http://www.w3.org/TR/pointerevents/
http://www.w3.org/TR/touch-events/	http://www.w3.org/TR/2009/WD-css3-transitions-20090320/#transition-events-
https://developer.mozilla.org/en-US/docs/Web/API/TransitionEvent	https://code.google.com/p/chromium/issues/detail?id=355103
http://www.w3.org/TR/2013/WD-DOM-Level-3-Events-20131105/#events-inputevents.	http://www.whatwg.org/specs/web-apps/current-work/multipage/the-input-element.html#input-type-attr-summary
https://github.com/facebook/react/issues/708.	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
https://bugzilla.mozilla.org/show_bug.cgi?id=208427	https://html.spec.whatwg.org/multipage/browsers.html#integration-with-idl
https://html.spec.whatwg.org/#do-not-apply	https://github.com/facebook/react/issues/19651
https://electronjs.org/docs/api/webview-tag	https://github.com/facebook/react/issues/11807
https://github.com/facebook/react/pull/11157.	https://www.w3.org/TR/html5/single-page.html#preprocessing-the-input-stream
https://www.quirksmode.org/blog/archives/2010/09/click_event_del.html	https://github.com/facebook/react/issues/6731#issuecomment-254874553
https://github.com/facebook/react/pull/6896	https://bugzilla.mozilla.org/show_bug.cgi?id=1276240
https://github.com/facebook/react/issues/13222	https://github.com/facebook/react/issues/14239
https://github.com/facebook/react/pull/10676.	https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-scope
https://html.spec.whatwg.org/multipage/syntax.html#special	https://html.spec.whatwg.org/multipage/syntax.html#html-integration-point
https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-button-scope	https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody	https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inselect

Page 1 of 2

Raw Manifest

{
  "name": "Armis Centrix",
  "icons": {
    "16": "resources/icon16.png",
    "32": "resources/icon32.png",
    "48": "resources/icon48.png",
    "128": "resources/icon128.png"
  },
  "action": {
    "default_title": "Settings"
  },
  "version": "1.2.0",
  "background": {
    "type": "module",
    "service_worker": "dist/background.js"
  },
  "side_panel": {
    "default_path": "settings.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Get insights from Armis Centrix directly in your browser",
  "permissions": [
    "activeTab",
    "contextMenus",
    "cookies",
    "declarativeNetRequest",
    "scripting",
    "sidePanel",
    "storage"
  ],
  "content_scripts": [
    {
      "js": [
        "dist/cve_selection_listener.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "https://*.armis.com/"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "dist/*.js.map",
        "dist/external/*.js",
        "resources/*"
      ]
    }
  ]
}

by ✦ Astarte

Armis Centrix

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (138 total):

Raw Manifest

Detections

Manifest Findings