[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Horse Wallpaper New Tab with Facts

Version 3.0.38 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Developer: https://www.horsestab.com/

Rating: 4.8 ★ (21 ratings)

Users: 2,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 3 total findings, including 2 high-risk findings.

Findings

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
topSites
tabs

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; script-src-elem 'self' 'unsafe-inline' https://mystart.mystartcdn.com https://*.firebaseio.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://mystart.mystartcdn.com https://maxcdn.bootstrapcdn.com
sandbox: sandbox allow-scripts; script-src 'self' 'https://apis.google.com/' 'https://www.gstatic.com/' 'https://*.firebaseio.com' 'https://*.firebasedatabase.app' 'https://www.googleapis.com' 'https://ajax.googleapis.com'; object-src 'self'

Embedded URLs (154 total):

https://www.google-analytics.com/collect	https://analytics.vmn.net/piwik.php?
https://www.google.com/s2/favicons?domain=	https://vmn.net
https://horsestab.com/contact/	https://horsestab.com/privacy/
https://horsestab.com/terms/	https://horsestab.mystartcdn.com/new-tab/
https://fonts.googleapis.com/css?family=Imprima	https://www.google.com/search?q=
https://horsestab.com/	https://www.facebook.com/MyStart/
https://gallery.mystartcdn.com/myhorses/gallery.json	https://gallery.mystartcdn.com/myhorses/images/MyHorses_581b5217151e0c7a11cbce63.jpeg
https://www.mystart.com/browser-extensions/switch/results.php?q=	https://horsestab.com/uninstall/
https://horsestab.com/thankyou/	https://clients2.google.com/service/update2/crx
https://mystart.mystartcdn.com	https://fonts.googleapis.com
https://maxcdn.bootstrapcdn.com	https://apis.google.com/
https://www.gstatic.com/	https://www.googleapis.com
https://ajax.googleapis.com	https://www.mystart.com/api/get_promobanner_feeds/
https://www.mystart.com/api/share/share.php	https://thumb.mystartcdn.com/api/v1/thumbnail/
https://chrome.google.com/webstore/detail/	http://www.json.org/json2.js
http://developer.piwik.org/guides/tracking-javascript-guide#multiple-piwik-trackers	https://ssl.google-analytics.com/collect
https://analytics.vmn.net/piwik.php	https://one.mystart.com/mystart-one://
https://www.facebook.com/sharer/sharer.php?u=	http://twitter.com/share?url=
https://mystart.com/browser-extensions/social/rate/v1.php	https://plus.google.com/share?url=
https://www.pinterest.com/pin/create/button/?url=	https://mail.google.com/mail/u/0/?view=cm&fs=1&to&su=
https://www.mystart.com/api/get_background_stats_extension/?ext=	https://www.mystart.com/api/set_background_stats_extension/
https://img.youtube.com/vi/	https://proxy.mystart.com/getyoutubevideos/feed.json?channelID=
https://mystart.com/api/autosuggest/	https://searchessweet.com/suggest?a=gsb_vsc_00_00_ssg&q=
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://mystart.mystartcdn.com/assets-new-tab/horses/breeds/	https://www.mystart.com/assets-new-tab/horses/data/infos.json
http://vmn.net	https://blog.mystart.com/
https://mystart.mystartcdn.com/assets-new-tab/images/heart.svg	https://mystart.mystartcdn.com/assets-new-tab/images/heart_filled.svg
https://mystart.mystartcdn.com/assets-new-tab/images/show_hide2.svg	https://mystart.mystartcdn.com/assets-new-tab/images/info-bubble-pinterest.svg
https://mystart.mystartcdn.com/assets-new-tab/images/info-bubble-pinterest-on.svg	https://mystart.mystartcdn.com/assets-new-tab/images/info-thumbup.svg
https://mystart.mystartcdn.com/assets-new-tab/images/info-thumbdown.svg	https://mystart.mystartcdn.com/assets-new-tab/images/info-share.svg
https://mystart.mystartcdn.com/assets-new-tab/images/info-bubble-fb.svg	https://mystart.mystartcdn.com/assets-new-tab/images/info-bubble-fb-over.svg
https://mystart.mystartcdn.com/assets-new-tab/images/custom_cursor_left.cur	https://mystart.mystartcdn.com/assets-new-tab/images/custom_cursor_right.cur
https://mystart.mystartcdn.com/assets-new-tab/images/search_btn_delete.png	https://mystart.mystartcdn.com/assets-new-tab/images/search.svg
https://mystart.mystartcdn.com/assets-new-tab/images/search3.svg	https://mystart.mystartcdn.com/assets-new-tab/images/ic-search-new.svg
https://mystart.mystartcdn.com/assets-new-tab/images/close.svg	https://mystart.mystartcdn.com/assets-new-tab/images/chev_left.svg
https://mystart.mystartcdn.com/assets-new-tab/images/chev_right.svg	https://mystart.mystartcdn.com/assets-new-tab/horses/gradient-top.png
https://mystart.mystartcdn.com/assets-new-tab/images/wallpapers_play_btn.png	https://mystart.mystartcdn.com/assets-new-tab/images/drop_arrow_down.svg
https://mystart.mystartcdn.com/assets-new-tab/images/drop_arrow_down_filled-small.svg	https://mystart.mystartcdn.com/assets-new-tab/hub/previous-arrow-shadow.png
https://mystart.mystartcdn.com/assets-new-tab/hub/next-arrow-shadow.png	https://mystart.mystartcdn.com/assets-new-tab/images/show_hide.svg
https://mystart.mystartcdn.com/assets-new-tab/hub/info.svg	https://mystart.mystartcdn.com/assets-new-tab/horses/icons/ico-search.svg

Page 1 of 2

Raw Manifest

{
  "name": "Horse Wallpaper New Tab with Facts",
  "icons": {
    "16": "icons/16.png",
    "38": "icons/38.png",
    "48": "icons/48.png",
    "64": "icons/64.png",
    "128": "icons/128.png"
  },
  "action": {
    "default_icon": {
      "64": "icons/64.png",
      "128": "icons/128.png"
    },
    "default_title": "Horse Wallpaper New Tab with Facts"
  },
  "version": "3.0.38",
  "background": {
    "type": "module",
    "service_worker": "main.js"
  },
  "short_name": "Horse",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Experience the majestic world of horses every time you open a new browser tab with Horse New Tab extension",
  "permissions": [
    "storage",
    "topSites",
    "tabs"
  ],
  "content_scripts": [
    {
      "js": [
        "js/content-scripts/installed.js",
        "js/content-scripts/event-handler.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.horsestab.com/*"
      ]
    }
  ],
  "manifest_version": 3,
  "chrome_url_overrides": {
    "newtab": "newtab/index.html"
  },
  "externally_connectable": {
    "matches": [
      "*://*.horsestab.com/*"
    ]
  },
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'self' 'https://apis.google.com/' 'https://www.gstatic.com/' 'https://*.firebaseio.com' 'https://*.firebasedatabase.app' 'https://www.googleapis.com' 'https://ajax.googleapis.com'; object-src 'self'",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; script-src-elem 'self' 'unsafe-inline' https://mystart.mystartcdn.com https://*.firebaseio.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com  https://mystart.mystartcdn.com https://maxcdn.bootstrapcdn.com"
  }
}

by ✦ Astarte

Horse Wallpaper New Tab with Facts

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (154 total):

Raw Manifest

Detections

Manifest Findings