[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Harmony Web Protection Advanced MV3

Version 990.103.26 View in Chrome Web Store

Last scanned: 7 months ago | force re-scan

Extension Details

Rating: 1.6 ★ (131 ratings)

Size: 2.86MiB

Last Updated: April 8, 2025

Users: 1,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

- The extension has a large user base of 1,000,000 users, indicating some level of trust and popularity.

- However, the low rating of 1.6/5 from 131 reviews raises concerns about the extension's quality and trustworthiness.

- The lack of developer information or company reputation makes it difficult to assess the trustworthiness of the extension's creators.

Concerns:

- The extension requests an extensive set of permissions, including the ability to intercept and modify web requests (webRequest, webRequestBlocking), access browsing history (history), download files (downloads), and inject scripts into any website (content scripts on <all_urls>).

- These permissions could potentially be abused to compromise user privacy, security, and data integrity.

- The combination of webRequest and webRequestBlocking permissions is particularly concerning, as it could be used to modify sensitive web traffic or steal data.

- The extension also requests access to user identity information (identity, identity.email), which could be a privacy risk.

Recommendations:

- Exercise extreme caution when installing this extension, as it poses a critical risk to your security and privacy.

- If you must use this extension, consider running it in a separate browser profile or a virtual machine to isolate it from your main browsing activity.

- Regularly review the extension's permissions and activity, and promptly remove it if any suspicious behavior is detected.

- Consider using alternative extensions or solutions from reputable developers with a proven track record of respecting user privacy and security.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

webRequest
webRequestBlocking
downloads
downloads.open
downloads.ui
storage
unlimitedStorage
notifications
tabs
activeTab
history
webNavigation
contextMenus
background
identity
identity.email
alarms

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' ; object-src 'self'

Embedded URLs (243 total):

https://cloudinfra-gw.portal.checkpoint.com/auth/external	https://rep.checkpoint.com/rep-auth/service/v1.0/request
http://www.w3.org/2001/XMLSchema-instance	https://gwevents.checkpoint.com/gwstats/services/antimalware/1_0_0/log
https://web-rep.iaas.checkpoint.com/web-rep/feedback	https://web-rep.checkpoint.com/web-rep/query
https://rep.checkpoint.com/url-rep/service/v2.0/query?resource=	https://www.surveymonkey.com/r/web-secure-uninstall-survey
https://clients2.google.com/service/update2/crx	https://www.checkpoint.com/products/advanced-endpoint-protection/
https://www.zonealarm.com/	https://www.zonealarm.com/anti-phishing
https://www.zonealarm.com/software/web-secure-free	https://sc1.checkpoint.com/sba/ff/stg.json
https://sc1.checkpoint.com/sba/ff/prod.json	https://url-rep.kube1.iaas.checkpoint.com/url-rep-ioc/service/v2.0/query?resource=
https://file-rep.kube1.iaas.checkpoint.com/file-rep-ioc/service/v2.0/query?resource=	https://url-rep.iaas.checkpoint.com/url-rep-ioc/service/v2.0/query?resource=
https://file-rep.iaas.checkpoint.com/file-rep-ioc/service/v2.0/query?resource=	https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
http://www.w3.org/TR/html4/strict.dtd	http://172.23.57.148/UserCheck/PortalMain?IID=BC15F7FD-B352-1DC9-BCFF-3BA462E295F5&origUrl=aHR0cDovL2FtYXpvbi5jb20v
https://www.checkpoint.com/privacy/	https://fonts.googleapis.com/css?family=Inter
https://sc1.checkpoint.com/www/images/layout/duke/check-point-logo.png	https://fonts.gstatic.com/s/opensans/v13/DXI1ORHCpsQm3Vp6mXoaTRsxEYwM7FgeyaSgU71cLG0.woff
https://fonts.gstatic.com/s/opensans/v13/uYKcPVoh6c5R0NpdEY5A-Q.woff	https://fonts.gstatic.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNShsxEYwM7FgeyaSgU71cLG0.woff
https://fonts.gstatic.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzBsxEYwM7FgeyaSgU71cLG0.woff	https://fonts.gstatic.com/s/opensans/v13/EInbV5DfGHOiMmvb1Xr-hhsxEYwM7FgeyaSgU71cLG0.woff
https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxv25ds880Du_gFZbUlZlsbg.woff	https://fonts.gstatic.com/s/opensans/v13/O4NhV7_qs9r9seTo7fnsVD8E0i7KZn-EPnyo3HZu7kw.woff
https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxsUW6j0fiq4_bYOAoMNnBhA.woff	https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxpXMLUeV6_io0G3F6eXSVcg.woff
https://fonts.gstatic.com/s/opensans/v13/PRmiXeptR36kaC0GEAetxjZJchHK-lPtiIaM3GRtbZU.woff	https://www.w3.org/TR/xml/#dt-charref
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://jquery.com/	https://sizzlejs.com/
https://jquery.org/license	https://github.com/eslint/eslint/issues/6125
http://jquery.org/license	https://jsperf.com/thor-indexof-vs-for/5
http://www.w3.org/TR/css3-selectors/#whitespace	http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier
http://www.w3.org/TR/selectors/#attribute-selectors	http://www.w3.org/TR/CSS21/syndata.html#escaped-characters
https://drafts.csswg.org/cssom/#common-serializing-idioms	https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled	https://html.spec.whatwg.org/multipage/forms.html#category-listed
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
https://bugs.jquery.com/ticket/13378	https://bugs.jquery.com/ticket/12359
https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section	http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked
https://bugs.webkit.org/show_bug.cgi?id=136851	https://github.com/jquery/sizzle/pull/225
http://www.w3.org/TR/selectors/#pseudo-classes	http://www.w3.org/TR/selectors/#lang-pseudo
http://www.w3.org/TR/selectors/#empty-pseudo	https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx
https://promisesaplus.com/#point-59	https://promisesaplus.com/#point-48
https://promisesaplus.com/#point-54	https://promisesaplus.com/#point-75
https://promisesaplus.com/#point-64	https://promisesaplus.com/#point-61
https://promisesaplus.com/#point-57	https://bugs.chromium.org/p/chromium/issues/detail?id=378607
https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click	https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	https://github.com/eslint/eslint/issues/3229
https://connect.microsoft.com/IE/feedback/details/1736512/	https://jsperf.com/getall-vs-sizzle/2
https://drafts.csswg.org/cssom/#resolved-values	https://developer.mozilla.org/en-US/docs/CSS/display

Page 1 of 4

Raw Manifest

{
  "name": "Harmony Web Protection Advanced MV3",
  "icons": {
    "16": "data/icons/CheckPointLogo_16.png",
    "48": "data/icons/CheckPointLogo_48.png",
    "128": "data/icons/CheckPointLogo_128.png"
  },
  "action": {
    "default_icon": {
      "19": "data/icons/CheckPointLogo_19.png"
    },
    "default_popup": "data/popup.html",
    "default_title": "Harmony Web Protection"
  },
  "storage": {
    "managed_schema": "schema.json"
  },
  "version": "990.103.26",
  "incognito": "split",
  "background": {
    "matches": [
      "<all_urls>"
    ],
    "service_worker": "background.js"
  },
  "short_name": "Harmony",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Protects users from advanced malware, phishing and zero-day attacks",
  "permissions": [
    "webRequest",
    "webRequestBlocking",
    "downloads",
    "downloads.open",
    "downloads.ui",
    "storage",
    "unlimitedStorage",
    "notifications",
    "tabs",
    "activeTab",
    "history",
    "webNavigation",
    "contextMenus",
    "background",
    "identity",
    "identity.email",
    "alarms"
  ],
  "homepage_url": "https://www.checkpoint.com/products/advanced-endpoint-protection//",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "data/cryptoJS-sha1.js",
        "data/cryptoJS-sha256.js",
        "data/cryptoJS-md5.js",
        "data/cryptoJS-lib-typedarrays-min.js",
        "data/homoglyph.js",
        "data/utils.js",
        "data/password_reuse_contentscript.js",
        "data/url_reputation_contentscript.js",
        "data/zero_phishing_contentscript.js",
        "data/upload_protection_contentscript.js",
        "data/dlp_contentscript.js",
        "data/contentscript_utils.js",
        "data/toast_notification_contentscript.js",
        "data/prompt_notification_contentscript.js",
        "data/dlp_prompt_notification_contentscript.js",
        "data/notification_contentscript.js",
        "data/mutation_observer.js",
        "data/favicon_fetcher.js",
        "data/common.js",
        "data/global_types.js",
        "data/hooks.js",
        "data/content_script.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' ; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "verifying_image.png",
        "data/BlockSite.html",
        "data/BlockSite-PR.html",
        "data/BlockSite-ZP.html",
        "data/BlockSite-Local-html.html",
        "data/downloader.html",
        "data/icons/errorIcon.svg",
        "data/icons/Harmony.svg",
        "data/icons/OKicon.svg",
        "data/icons/warningIcon.svg",
        "data/one_time_link.js",
        "data/css/Toast.css",
        "data/css/Prompt.css",
        "data/css/DLPPrompt.css",
        "data/notify_events.js",
        "data/broken_links.js",
        "data/track_input_creation.js",
        "data/icons/info_status_icon.svg",
        "data/icons/success_status_icon.svg",
        "data/icons/warning_status_icon.svg",
        "data/icons/error_status_icon.svg",
        "data/icons/ext_icon.svg",
        "data/icons/toast_arrow.gif",
        "data/icons/toast_cb_checked.svg",
        "data/icons/prompt_close_button.svg",
        "data/icons/prompt_company_icon.svg",
        "data/downloader.js",
        "data/shadow_root_detection.js",
        "data/show_file_picker.js",
        "data/notify_clipboard_change.js"
      ]
    }
  ]
}

by ✦ Astarte

Harmony Web Protection Advanced MV3

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (243 total):

Raw Manifest

Detections

Manifest Findings