[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Rakuten: Get Cash Back For Shopping

Version 26.18.2 View in Chrome Web Store

Last scanned: about 6 hours ago

Extension Details

Developer: http://rakuten.com/

Rating: 4.9 ★ (43.6K ratings)

Users: 3,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 6 total findings, including 5 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
webNavigation
webRequest
storage
cookies
alarms
scripting

Optional Permissions:

notifications

Host Permissions:

<all_urls>

Embedded URLs (219 total):

https://babel.dev/team	https://github.com/babel/babel.git
https://github.com/braintree/sanitize-url.git	https://github.com/chakra-ui/chakra-ui.git
https://github.com/chakra-ui/chakra-ui	https://github.com/didomi/react
https://github.com/emotion-js/emotion/tree/main/packages/cache	https://github.com/emotion-js/emotion/tree/main/packages/hash
https://github.com/emotion-js/emotion/tree/main/packages/is-prop-valid	https://github.com/emotion-js/emotion/tree/main/packages/memoize
https://github.com/emotion-js/emotion/tree/main/packages/react	https://github.com/emotion-js/emotion/tree/main/packages/serialize
https://github.com/emotion-js/emotion/tree/main/packages/sheet	https://github.com/emotion-js/emotion/tree/main/packages/styled
https://github.com/emotion-js/emotion/tree/main/packages/unitless	https://github.com/emotion-js/emotion/tree/main/packages/use-insertion-effect-with-fallbacks
https://github.com/emotion-js/emotion/tree/main/packages/utils	https://github.com/emotion-js/emotion/tree/main/packages/weak-memoize
https://github.com/module-federation/core/	https://github.com/swc-project/swc.git
http://www.apache.org/licenses/	http://www.apache.org/licenses/LICENSE-2.0
https://github.com/TanStack/query.git	https://github.com/chakra-ui/zag/tree/main/packages/utilities/dom-helpers
https://github.com/chakra-ui/zag/tree/main/packages/utilities/element-size	https://github.com/chakra-ui/zag/tree/main/packages/utilities/focus-visible
https://www.openexchangerates.org	https://github.com/theKashey/aria-hidden.git
https://github.com/axios/axios.git	https://github.com/arthurfiorette/axios-cache-interceptor.git
https://github.com/babel/babel-loader.git	https://github.com/jashkenas/backbone.git
https://github.com/arthurfiorette/tinylibs.git	http://vorb.de
https://github.com/ricokahler/color2k.git	https://github.com/omichelsen/compare-versions.git
https://github.com/sudodoki/copy-to-clipboard	https://github.com/iamkun/dayjs.git
https://github.com/fb55/entities.git	https://sindresorhus.com
http://jeditoolkit.com	https://github.com/epoberezkin/fast-deep-equal.git
https://github.com/theKashey/focus-lock.git	https://github.com/focus-trap/focus-trap.git
https://github.com/focus-trap/focus-trap-react.git	https://github.com/WICG/focus-visible.git
http://www.w3.org/Consortium/Legal/2015/copyright-software-and-document	https://www.w3.org/community/about/agreements/cla/
https://github.com/motiondivision/motion/	https://github.com/Popmotion/popmotion.git
https://github.com/krisk/Fuse.git	https://github.com/i18next/html-parse-stringify.git
https://github.com/i18next	https://github.com/jamuhl
https://github.com/i18next/i18next.git	https://github.com/i18next/i18next-browser-languageDetector.git
https://github.com/immerjs/immer.git	https://github.com/jonschlinkert
https://github.com/jquery/jquery.git	https://openjsf.org/
https://github.com/apostrophecms/apostrophe.git	http://underscorejs.org/
https://github.com/lodash/lodash	http://creativecommons.org/publicdomain/zero/1.0/
https://github.com/airbnb/lottie-web.git	http://paul.vorba.ch
https://github.com/motiondivision/motion	https://motion.dev
https://github.com/albell/parse-srcset.git	https://github.com/facebook/react.git
http://github.com/gaearon	https://github.com/thekashey/react-clientside-effect.git
https://github.com/ItsBenCodes/cookies.git	https://github.com/FormidableLabs/react-fast-compare
https://github.com/theKashey/react-focus-lock.git	https://github.com/i18next/react-i18next.git
https://github.com/theKashey/react-remove-scroll	https://github.com/theKashey/react-remove-scroll-bar
https://github.com/theKashey/react-style-singleton	https://github.com/oliviertassinari

Page 1 of 3

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "img/icon/icon-32.png",
    "48": "img/icon/icon-64.png",
    "128": "img/icon/icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "img/icon/icon-32.png",
      "32": "img/icon/icon-32.png"
    },
    "default_title": "__MSG_extensionName__"
  },
  "author": "Rakuten",
  "version": "26.18.2",
  "incognito": "split",
  "background": {
    "service_worker": "js/bg.js"
  },
  "options_ui": {
    "page": "settings.html",
    "open_in_tab": true
  },
  "short_name": "Rakuten",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "tabs",
    "webNavigation",
    "webRequest",
    "storage",
    "cookies",
    "alarms",
    "scripting"
  ],
  "homepage_url": "https://www.rakuten.com/",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/libs/snippet.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.rakuten.com/*",
        "https://*.rakuten.co.uk/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "notifications"
  ],
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "workers/*.js",
        "*.css",
        "*.js",
        "fonts/*.woff",
        "fonts/*.woff2",
        "fonts/*.ttf",
        "fonts/*.otf",
        "img/*",
        "json/np-bloom.json"
      ]
    }
  ]
}

by ✦ Astarte

Rakuten: Get Cash Back For Shopping

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (219 total):

Raw Manifest

Detections

Manifest Findings