SYMBL: Unicode & Emoji Picker

Version 1.0.0 View in Chrome Web Store

Last scanned: about 1 month ago | force re-scan

Extension Details

Developer: symbl.cc

Rating: 5.0 ★ (4 ratings)

Users: 140

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a perfect 5.0 rating, though this is based on only 4 reviews from a very small user base of 140 users. The developer appears to be associated with symbl.cc, which aligns with the extension's Unicode/emoji functionality. However, the extremely low adoption rate and recent release (version 1.0.0) provide limited evidence of trustworthiness or community vetting.

Concerns:

The primary concern is the broad host permissions to https://symbl.cc/*, which seems excessive for a Unicode and emoji picker tool. While this permission is limited to a single domain (the developer's website), it still allows the extension to access and potentially modify all content on that site. For a utility that should primarily function as a local picker tool, any host permissions raise questions about data collection or remote functionality that may not be necessary for core operations.

Recommendations:

Given the medium risk level, consider running this extension in a separate Chrome profile if you frequently handle sensitive information. Before installing, verify that the symbl.cc website is legitimate and review their privacy policy. Monitor the extension's behavior to ensure it only activates when you explicitly use the Unicode/emoji picker functionality. Consider alternative emoji picker extensions with larger user bases and more transparent permission models if this functionality is critical to your workflow.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

Security Analysis Details

Host Permissions:

https://symbl.cc/*

Embedded URLs (22 total):

https://symbl.cc/api/search/	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://clients2.google.com/service/update2/crx
https://symbl.cc/	https://symbl.cc
https://docs.gitlab.com/ee/user/project/repository/web_editor.html#create-a-file	https://docs.gitlab.com/ee/user/project/repository/web_editor.html#upload-a-file
https://docs.gitlab.com/ee/gitlab-basics/add-file.html#add-a-file-using-the-command-line	https://gitlab.asanov.agency/symbl/symbl-chrome-extension.git
https://gitlab.asanov.agency/symbl/symbl-chrome-extension/-/settings/integrations	https://docs.gitlab.com/ee/user/project/members/
https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html	https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#closing-issues-automatically
https://docs.gitlab.com/ee/user/project/merge_requests/approvals/	https://docs.gitlab.com/ee/user/project/merge_requests/merge_when_pipeline_succeeds.html
https://docs.gitlab.com/ee/ci/quick_start/index.html	https://docs.gitlab.com/ee/user/application_security/sast/
https://docs.gitlab.com/ee/topics/autodevops/requirements.html	https://docs.gitlab.com/ee/user/clusters/agent/
https://docs.gitlab.com/ee/ci/environments/protected_environments.html	https://www.makeareadme.com/

Raw Manifest

{
  "name": "SYMBL: Unicode & Emoji Picker",
  "icons": {
    "16": "icons/icon16.png",
    "32": "icons/icon32.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon16.png",
      "32": "icons/icon32.png"
    },
    "default_popup": "popup.html"
  },
  "version": "1.0.0",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Find, Copy & Paste Unicode Symbols & Emoji",
  "host_permissions": [
    "https://symbl.cc/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte