[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Browserling – Cross-browser Testing

Version 2.0.0 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Developer: https://www.browserling.com/

Rating: 3.1 ★ (68 ratings)

Users: 9,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension is developed by Browserling, a legitimate company that provides cross-browser testing services. However, the relatively low user count (9,000) and modest rating (3.1/5 from 68 reviews) suggest limited adoption and mixed user satisfaction. The company appears to be established in the browser testing space, which adds some credibility to their extension.

Concerns: The primary concern is the broad host permissions that allow access to all Browserling domains, which could potentially be exploited if the extension or company systems were compromised. The activeTab permission, while necessary for cross-browser testing functionality, does provide access to sensitive page content when the extension is activated. The combination of activeTab and storage permissions means the extension can potentially capture and store data from any website you're testing.

The scripting permission allows code injection into web pages, which is typical for testing tools but increases the attack surface. The contextMenus permission, while lower risk, adds another interaction point that could be misused.

Recommendations: Given the medium risk level, consider running this extension in a separate Chrome profile dedicated to development and testing activities. Avoid using it while browsing sensitive sites like banking or personal accounts. Regularly review what data the extension might be storing locally. Monitor the extension's behavior and disable it when not actively conducting cross-browser testing to minimize exposure.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "Browserling – Cross-browser Testing",
  "icons": {
    "16": "icons/icon-16x16.png",
    "48": "icons/icon-48x48.png",
    "128": "icons/icon-128x128.png"
  },
  "action": {
    "default_icon": {
      "19": "icons/icon-19x19.png",
      "38": "icons/icon-76x76.png"
    },
    "default_popup": "popup.html",
    "default_title": "Browserling – Cross-browser Testing"
  },
  "version": "2.0.0",
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "Browserling",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Cross-browser test websites in the most popular browsers such as Edge, Chrome, Firefox, Safari, Opera, and IE. Try for free!",
  "permissions": [
    "activeTab",
    "storage",
    "contextMenus",
    "scripting"
  ],
  "homepage_url": "https://www.browserling.com/",
  "host_permissions": [
    "https://www.browserling.com/*",
    "https://browserling.com/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte

https://www.browserling.com	http://www.apache.org/licenses/
http://www.apache.org/licenses/LICENSE-2.0	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
http://www.w3.org/2000/svg	https://duckduckgo.com/?q=
https://www.browserling.com/browse/	https://www.browserling.com/browsers.json
https://clients2.google.com/service/update2/crx	https://www.browserling.com/
https://browserling.com/

Browserling – Cross-browser Testing

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (11 total):

Raw Manifest

Detections

Manifest Findings