[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Harmony Web Protection Advanced MV3

Version 990.106.112 View in Chrome Web Store

Last scanned: 15 days ago | force re-scan

Extension Details

Rating: 1.6 ★ (140 ratings)

Users: 1,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has 1 million users, suggesting widespread adoption, but the extremely low rating of 1.6 out of 5 stars from 140 reviews is a major red flag. This indicates significant user dissatisfaction and potential issues with the extension's functionality or behavior. The lack of clear developer information and company details further reduces trustworthiness.

Concerns:

The extension requests an excessive number of high-risk permissions that far exceed what would be necessary for typical web protection. The combination of webRequest and webRequestBlocking permissions allows complete interception and modification of all web traffic. Access to browsing history, downloads, identity information, and unlimited storage creates a comprehensive surveillance capability. The broad host permissions and content script injection across all websites enable the extension to monitor and modify any web activity. The dangerous permission combinations suggest potential for data theft, traffic manipulation, or comprehensive user tracking.

Recommendations:

Do not install this extension. The combination of critical security risks, extremely poor user ratings, and excessive permissions creates an unacceptable security threat. If web protection is needed, choose a well-established security vendor with transparent policies and better user reviews. If you must use this extension for organizational requirements, run it in a completely isolated Chrome profile with no access to personal accounts or sensitive data, and monitor network traffic for suspicious activity.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

webRequest
webRequestBlocking
downloads
downloads.open
downloads.ui
storage
unlimitedStorage
notifications
tabs
activeTab
history
webNavigation
contextMenus
background
identity
identity.email
alarms

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' ; object-src 'self'

Embedded URLs (251 total):

https://google.com/search	https://www.google.com/search
https://www.perplexity.ai/b/home	https://cloudinfra-gw.portal.checkpoint.com/auth/external
https://rep.checkpoint.com/rep-auth/service/v1.0/request	http://www.w3.org/2001/XMLSchema-instance
https://gwevents.checkpoint.com/gwstats/services/antimalware/1_0_0/log	https://web-rep.iaas.checkpoint.com/web-rep/feedback
https://web-rep.checkpoint.com/web-rep/query	https://rep.checkpoint.com/url-rep/service/v2.0/query?resource=
https://api-iam.intercom.io/messenger/web/ping	https://api.openai.com/auth
https://api.openai.com/profile	https://chatgpt.com/backend-api/
https://www.surveymonkey.com/r/web-secure-uninstall-survey	https://clients2.google.com/service/update2/crx
https://www.checkpoint.com/products/advanced-endpoint-protection/	https://www.zonealarm.com/
https://www.zonealarm.com/anti-phishing	https://www.zonealarm.com/software/web-secure-free
https://url-rep.kube1.iaas.checkpoint.com/url-rep-ioc/service/v2.0/query?resource=	https://file-rep.kube1.iaas.checkpoint.com/file-rep-ioc/service/v2.0/query?resource=
https://url-rep.iaas.checkpoint.com/url-rep-ioc/service/v2.0/query?resource=	https://file-rep.iaas.checkpoint.com/file-rep-ioc/service/v2.0/query?resource=
https://fonts.googleapis.com/css2?family=Open+Sans&display=swap	https://sc1.checkpoint.com/sba/ff/stg.json
https://sc1.checkpoint.com/sba/ff/prod.json	http://www.w3.org/TR/html4/strict.dtd
http://172.23.57.148/UserCheck/PortalMain?IID=BC15F7FD-B352-1DC9-BCFF-3BA462E295F5&origUrl=aHR0cDovL2FtYXpvbi5jb20v	https://www.checkpoint.com/privacy/
https://fonts.googleapis.com/css?family=Inter	https://sc1.checkpoint.com/www/images/layout/duke/check-point-logo.png
https://fonts.gstatic.com/s/opensans/v13/DXI1ORHCpsQm3Vp6mXoaTRsxEYwM7FgeyaSgU71cLG0.woff	https://fonts.gstatic.com/s/opensans/v13/uYKcPVoh6c5R0NpdEY5A-Q.woff
https://fonts.gstatic.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNShsxEYwM7FgeyaSgU71cLG0.woff	https://fonts.gstatic.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzBsxEYwM7FgeyaSgU71cLG0.woff
https://fonts.gstatic.com/s/opensans/v13/EInbV5DfGHOiMmvb1Xr-hhsxEYwM7FgeyaSgU71cLG0.woff	https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxv25ds880Du_gFZbUlZlsbg.woff
https://fonts.gstatic.com/s/opensans/v13/O4NhV7_qs9r9seTo7fnsVD8E0i7KZn-EPnyo3HZu7kw.woff	https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxsUW6j0fiq4_bYOAoMNnBhA.woff
https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxpXMLUeV6_io0G3F6eXSVcg.woff	https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxjZJchHK-lPtiIaM3GRtbZU.woff
https://www.w3.org/TR/xml/#dt-charref	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://jquery.com/
https://sizzlejs.com/	https://jquery.org/license
https://github.com/eslint/eslint/issues/6125	http://jquery.org/license
https://jsperf.com/thor-indexof-vs-for/5	http://www.w3.org/TR/css3-selectors/#whitespace
http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier	http://www.w3.org/TR/selectors/#attribute-selectors
http://www.w3.org/TR/CSS21/syndata.html#escaped-characters	https://drafts.csswg.org/cssom/#common-serializing-idioms
https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled	https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
https://html.spec.whatwg.org/multipage/forms.html#category-listed	https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled	https://bugs.jquery.com/ticket/13378
https://bugs.jquery.com/ticket/12359	https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section
http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked	https://bugs.webkit.org/show_bug.cgi?id=136851
https://github.com/jquery/sizzle/pull/225	http://www.w3.org/TR/selectors/#pseudo-classes
http://www.w3.org/TR/selectors/#lang-pseudo	http://www.w3.org/TR/selectors/#empty-pseudo
https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx	https://promisesaplus.com/#point-59
https://promisesaplus.com/#point-48	https://promisesaplus.com/#point-54
https://promisesaplus.com/#point-75	https://promisesaplus.com/#point-64
https://promisesaplus.com/#point-61	https://promisesaplus.com/#point-57
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click

Page 1 of 4

Raw Manifest

{
  "name": "Harmony Web Protection Advanced MV3",
  "icons": {
    "16": "data/icons/CheckPointLogo_16.png",
    "48": "data/icons/CheckPointLogo_48.png",
    "128": "data/icons/CheckPointLogo_128.png"
  },
  "action": {
    "default_icon": {
      "19": "data/icons/CheckPointLogo_19.png"
    },
    "default_title": "Harmony Web Protection"
  },
  "storage": {
    "managed_schema": "schema.json"
  },
  "version": "990.106.112",
  "incognito": "split",
  "background": {
    "matches": [
      "<all_urls>"
    ],
    "service_worker": "background.js"
  },
  "short_name": "Harmony",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Protects users from advanced malware, phishing and zero-day attacks",
  "permissions": [
    "webRequest",
    "webRequestBlocking",
    "downloads",
    "downloads.open",
    "downloads.ui",
    "storage",
    "unlimitedStorage",
    "notifications",
    "tabs",
    "activeTab",
    "history",
    "webNavigation",
    "contextMenus",
    "background",
    "identity",
    "identity.email",
    "alarms"
  ],
  "homepage_url": "https://www.checkpoint.com/products/advanced-endpoint-protection//",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "data/cryptoJS-sha1.js",
        "data/cryptoJS-sha256.js",
        "data/cryptoJS-md5.js",
        "data/cryptoJS-aes.js",
        "data/cryptoJS-lib-typedarrays-min.js",
        "data/homoglyph.js",
        "data/utils.js",
        "data/password_reuse_contentscript.js",
        "data/url_reputation_contentscript.js",
        "data/zero_phishing_contentscript.js",
        "data/upload_protection_contentscript.js",
        "data/dlp_contentscript.js",
        "data/dlp_contentscript_async.js",
        "data/contentscript_utils.js",
        "data/toast_notification_contentscript.js",
        "data/prompt_notification_contentscript.js",
        "data/dlp_prompt_notification_contentscript.js",
        "data/dlp_common.js",
        "data/notification_contentscript.js",
        "data/mutation_observer.js",
        "data/favicon_fetcher.js",
        "data/favicon_fetcher_wrapper.js",
        "data/common.js",
        "data/global_types.js",
        "data/ssdeep.js",
        "data/hooks.js",
        "data/feature_flags.js",
        "data/manage_storage.js",
        "data/clickfix_utils_cs.js",
        "data/content_script.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' ; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "verifying_image.png",
        "data/BlockSite.html",
        "data/BlockSite-PR.html",
        "data/BlockSite-ZP.html",
        "data/BlockSite-Local-html.html",
        "data/downloader.html",
        "data/icons/errorIcon.svg",
        "data/icons/Harmony.svg",
        "data/icons/OKicon.svg",
        "data/icons/warningIcon.svg",
        "data/one_time_link.js",
        "data/iframe_download.js",
        "data/json_read.js",
        "data/css/Toast.css",
        "data/css/Prompt.css",
        "data/css/DLPPrompt.css",
        "data/notify_events.js",
        "data/broken_links.js",
        "data/track_input_creation.js",
        "data/icons/info_status_icon.svg",
        "data/icons/success_status_icon.svg",
        "data/icons/warning_status_icon.svg",
        "data/icons/error_status_icon.svg",
        "data/icons/ext_icon.svg",
        "data/icons/toast_arrow.gif",
        "data/icons/toast_cb_checked.svg",
        "data/icons/prompt_close_button.svg",
        "data/icons/prompt_company_icon.svg",
        "data/downloader.js",
        "data/shadow_root_detection.js",
        "data/focus_handler.js",
        "data/show_file_picker.js",
        "data/notify_clipboard_change.js",
        "data/spa_navigation_handler.js",
        "data/lexical_editor_input.js"
      ]
    }
  ]
}

by ✦ Astarte

Harmony Web Protection Advanced MV3

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (251 total):

Raw Manifest

Detections

Manifest Findings