[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Top and Bottom scroll buttons

Version 2.0.0 View in Chrome Web Store

Last scanned: 4 months ago | force re-scan

Extension Details

Rating: 4.5 ★ (41 ratings)

Users: 5,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a decent user base of 5,000 users and a good rating of 4.5 stars from 41 reviews, suggesting users find it functional. However, the lack of developer information and company details reduces transparency and accountability.

Concerns: The extension's permissions are severely excessive for its stated purpose of providing scroll buttons. The <all_urls> host permissions and content script injection capabilities allow it to access and modify every website you visit, which is completely unnecessary for adding simple scroll functionality. This creates significant privacy and security risks, as the extension could potentially steal sensitive data, track browsing activity, or inject malicious content across all websites.

The storage permission, while less concerning, allows the extension to store data locally, which could be used to maintain persistent tracking information.

Recommendations: Given the disproportionate permissions relative to functionality, consider using this extension in a separate Chrome profile dedicated to non-sensitive browsing activities. Alternatively, look for similar scroll enhancement extensions that request more appropriate, limited permissions. Before using, carefully review what data the extension might access and consider whether the convenience of scroll buttons justifies the broad access to all your web activity. Monitor the extension's behavior and remove it immediately if you notice any suspicious activity or unexpected data usage.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage

Host Permissions:

<all_urls>

Embedded URLs (15 total):

https://www.youtube.com	https://www.patreon.com/bePatron?u=8504106
https://paypal.me/dmytrozo	https://commerce.coinbase.com/checkout/07631549-9b04-4f45-8d3e-cf7ed46e9ac8
http://www.inkscape.org/	http://purl.org/dc/elements/1.1/
http://creativecommons.org/ns#	http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://www.w3.org/2000/svg	http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
http://www.inkscape.org/namespaces/inkscape	http://purl.org/dc/dcmitype/StillImage
https://streamdevprojects.com/und/ext-an	http://streamdevprojects.com/und#pro
https://clients2.google.com/service/update2/crx

Raw Manifest

{
  "name": "Top and Bottom scroll buttons",
  "icons": {
    "48": "img/icon-48.png",
    "96": "img/icon-96.png",
    "128": "img/icon-128.png"
  },
  "action": {
    "default_popup": "content/popup.html"
  },
  "version": "2.0.0",
  "options_ui": {
    "page": "options/options.html",
    "open_in_tab": true
  },
  "short_name": "Scroll buttons",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Adds scroll to Top and Bottom buttons on all sites",
  "permissions": [
    "storage"
  ],
  "content_scripts": [
    {
      "js": [
        "options/options-storage.js",
        "content/buttons.js"
      ],
      "css": [
        "content/buttons.css"
      ],
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "img/arrow-up.svg",
        "img/arrow-dn.svg"
      ]
    }
  ]
}

by ✦ Astarte

Top and Bottom scroll buttons

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (15 total):

Raw Manifest

Detections

Manifest Findings