[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Navina Addon

Version 6.1.13 View in Chrome Web Store

Last scanned: about 10 hours ago

Extension Details

Rating: 5.0 ★ (1 rating)

Users: 10,000

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 2 total findings, including 1 high-risk finding.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage

Embedded URLs (16 total):

https://nmf3ldhlpg.execute-api.us-east-1.amazonaws.com/default/	https://summaries-api.navina.ai/
https://ecwprodcefqhc.s4ch.net	https://ecw-metro.s4ch.net
https://summaries-api.staging.navina.ai/api/public/nakama-addon-api/v1/addon/	https://summaries-api.navina.ai/api/public/nakama-addon-api/v1/addon/
https://staging.navina.ai/	http://www.w3.org/2000/svg
https://app.navina.ai/	https://p2e.navina.ai/
https://addon-api.navina.ai/api_gateway-emr_logs-save_log_to_db	http://schemas.xmlsoap.org/soap/envelope/
http://schemas.xmlsoap.org/soap/encoding/	http://www.w3.org/1999/XMLSchema
http://www.w3.org/1999/XMLSchema-instance	https://clients2.google.com/service/update2/crx

Raw Manifest

{
  "name": "Navina Addon",
  "icons": {
    "16": "icon.png",
    "48": "icon.png",
    "128": "icon.png"
  },
  "version": "6.1.13",
  "background": {
    "service_worker": "js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "The Navina extension adds integration between the Navina system and your EMR.",
  "permissions": [
    "storage"
  ],
  "content_scripts": [
    {
      "js": [
        "js/content_script.js"
      ],
      "run_at": "document_end",
      "matches": [
        "*://*/*"
      ]
    }
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "js/injected_script_ecw.js",
        "css/injected_style_ecw.css",
        "font/*.woff2",
        "iframe.html",
        "sso-iframe.html",
        "post-visit-popup-iframe.html"
      ]
    }
  ]
}

by ✦ Astarte