[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

SmartCast

Version 1.0.0 View in Chrome Web Store

Last scanned: 1 day ago | force re-scan

Extension Details

Rating: 0.0 ★

Users: 2

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: This extension presents significant trust concerns. With only 2 users, no rating, and missing critical metadata like author information and last update date, it appears to be either newly published or potentially abandoned. The lack of developer transparency and minimal user adoption raises red flags about legitimacy.

Concerns:

- The cookies permission combined with broad host permissions to smartcastaddon.com creates a dangerous combination that could enable session hijacking or credential theft

- Despite the name "SmartCast" suggesting media functionality, the permissions don't align with typical casting operations, which usually require different permissions

- The broad host permissions allow access to all subdomains of smartcastaddon.com, creating an unnecessarily wide attack surface

- Missing developer information makes it impossible to verify the extension's legitimacy or contact the creator for security concerns

- The extremely low user count suggests this extension hasn't been vetted by the community

Recommendations:

Install this extension in a completely separate Chrome profile if you must use it, and never use that profile for sensitive activities like banking or work. Consider using Chrome's incognito mode with extensions disabled when accessing important websites. Monitor your browser's cookie storage and clear cookies regularly if you install this extension. Given the high risk and lack of transparency, strongly consider finding alternative solutions from more established developers with clear track records.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "SmartCast",
  "icons": {
    "16": "icons/png/icon-16.png",
    "32": "icons/png/icon-32.png",
    "48": "icons/png/icon-48.png",
    "128": "icons/png/icon-128.png",
    "256": "icons/png/icon-256.png",
    "512": "icons/png/icon-512.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/png/icon-16.png",
      "32": "icons/png/icon-32.png",
      "48": "icons/png/icon-48.png",
      "128": "icons/png/icon-128.png"
    },
    "default_popup": "popup.html",
    "default_title": "SmartCast"
  },
  "version": "1.0.0",
  "background": {
    "type": "module",
    "service_worker": "js/background.js"
  },
  "short_name": "SmartCast",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Fast and Focused Search for Podcasts",
  "permissions": [
    "storage",
    "cookies"
  ],
  "homepage_url": "https://smartcastaddon.com/",
  "host_permissions": [
    "*://*.smartcastaddon.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

by ✦ Astarte

https://clients2.google.com/service/update2/crx	https://smartcastaddon.com/
https://fonts.googleapis.com	https://fonts.gstatic.com
https://fonts.googleapis.com/css2?family=Noto+Sans:ital	https://smartcastaddon.com/uninstall/
https://smartcastaddon.com/privacy/	https://smartcastaddon.com/tou/
https://www.smartcastaddon.com/	https://search.yahoo.com/search?
https://searching.smartcastaddon.com/query/to?query=

SmartCast

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (11 total):

Raw Manifest

Detections

Manifest Findings