Frame By Frame

Version 3.5 View in Chrome Web Store

Last scanned: 8 days ago | force re-scan

Extension Details

Rating: 3.8 ★ (40 ratings)

Users: 10,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a moderate user base of 10,000 users and an average rating of 3.8 stars from 40 reviews, suggesting basic functionality but mixed user satisfaction. However, the lack of clear author information and developer details raises transparency concerns. The name "Frame By Frame" suggests video-related functionality, which could justify some web access needs.

Concerns: The extension's permissions are disproportionately broad for what appears to be a video frame analysis tool. The <all_urls> host permissions and content script injection capabilities create significant security risks, allowing the extension to access and modify content on every website you visit. This level of access far exceeds what would typically be necessary for frame-by-frame video analysis. The storage permission, while less concerning, adds to the overall risk profile by enabling data collection and retention.

Recommendations: Given the high risk level, consider running this extension in a separate Chrome profile dedicated to video work if you must use it. Before installation, verify that the functionality truly requires such broad permissions by testing alternatives with more restrictive access. Monitor your browsing activity for any unusual behavior after installation. Consider whether browser-based video analysis tools or desktop applications might provide similar functionality with better security isolation. If keeping the extension, regularly review its behavior and disable it when not actively needed for video work.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "Frame By Frame",
  "icons": {
    "16": "assets/icons/16.png",
    "32": "assets/icons/32.png",
    "48": "assets/icons/48.png",
    "128": "assets/icons/128.png"
  },
  "action": {
    "default_popup": "options-page/index.html"
  },
  "version": "3.5",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "storage"
  ],
  "options_page": "options-page/index.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content-scripts/core.js",
        "content-scripts/cursor.js",
        "content-scripts/events.js",
        "content-scripts/locale.js",
        "content-scripts/messages.js",
        "content-scripts/observer.js",
        "content-scripts/storage.js",
        "content-scripts/ui.js",
        "content-scripts/videos.js",
        "content-scripts/init.js",
        "content-scripts/features/data.js",
        "content-scripts/features/events.js",
        "content-scripts/features/storage.js",
        "content-scripts/features/ui.js"
      ],
      "css": [
        "content-scripts/styles.css"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "offline_enabled": true,
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "downloads"
  ]
}

by ✦ Astarte

http://www.w3.org/2000/svg	https://addons.mozilla.org
https://chrome.google.com/webstore	https://microsoftedge.microsoft.com/addons
https://clients2.google.com/service/update2/crx

Frame By Frame

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (5 total):

Raw Manifest

Detections

Manifest Findings