[ new scan ] [ statistics ] [ github ] [ twitter ]

Fileon - S3 Browser

Version 1.0.8 View in Chrome Web Store

Last scanned: 19 days ago | force re-scan

Extension Details

Developer: fileon.io

Rating: 3.4 ★ (10 ratings)

Size: 1.11MiB

Last Updated: October 8, 2021

Users: 6,000

Context-Aware Verdict

HIGH

Risk Level

Trust Factors:

- The extension has a relatively low number of users (6,000) and ratings (10), which could indicate a lack of widespread trust or adoption.

- The developer information is limited, making it difficult to assess their reputation or track record.

Concerns:

- The extension requests broad host permissions (*://*/*), allowing it to access and potentially modify data on any website. This is an unnecessary level of access for an S3 browser extension and raises privacy and security concerns.

- The extension's size (1.11MiB) seems large for its stated functionality, which could indicate the presence of additional, undisclosed code or functionality.

Recommendations:

- Exercise caution when installing and using this extension, as the broad permissions and limited information about the developer raise red flags.

- Consider using alternative, more reputable S3 browser extensions or tools from trusted sources.

- If you decide to use this extension, it is recommended to run it in a separate browser profile or a sandboxed environment to isolate it from your main browsing activity and sensitive data.

- Regularly review the extension's permissions and behavior, and uninstall it if any suspicious activity is detected.

Security Analysis

MEDIUM

Overall Risk

Based on 1 total findings, ranked without considering overall context, including 1 high-risk and 0 medium-risk findings.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

Security Analysis Details

Host Permissions:

*://*/*

Embedded URLs (50 total):

http://www.w3.org/2000/svg	https://g.co/ng/security#xss
http://www.w3.org/1998/MathML/	https://npms.io/search?q=ponyfill.
http://www.w3.org/1999/xlink	https://cdn.plyr.io/3.6.8/plyr.svg
https://cdn.plyr.io/static/blank.mp4	https://player.vimeo.com/api/player.js
https://player.vimeo.com/video/	https://vimeo.com/api/oembed.json?url=
https://www.youtube.com/iframe_api	https://noembed.com/embed?url=https://www.youtube.com/watch?v=
https://imasdk.googleapis.com/js/sdkloader/ima3.js	https://www.youtube-nocookie.com
http://www.youtube.com	https://i.ytimg.com/vi/
https://go.aniview.com/api/adserver6/vast/?	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://git.io/fjule	http://s3.amazonaws.com/doc/2006-03-01/
http://www.w3.org/2001/XMLSchema-instance	http://acs.amazonaws.com/groups/global/AllUsers
http://acs.amazonaws.com/groups/global/AuthenticatedUsers	http://acs.amazonaws.com/groups/s3/LogDelivery
http://www.w3.org/1999/xhtml	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/	https://www.fileon.io
https://via.placeholder.com/333x220?text=333x220+MPU	https://getbootstrap.com/
https://github.com/twbs/bootstrap/blob/main/LICENSE	https://animate.style/
http://opensource.org/licenses/MIT	http://kossnocorp.mit-license.org
https://tldrlegal.com/license/mit-license	https://openjsf.org/
http://underscorejs.org/	https://github.com/lodash/lodash
http://creativecommons.org/publicdomain/zero/1.0/	https://github.com/joyent/node
http://www.apache.org/licenses/	http://www.apache.org/licenses/LICENSE-2.0
https://angular.io/license	https://developer.chrome.com/docs/extensions/reference/events/
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Object_initializer#new_notations_in_ecmascript_2015	https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Asynchronous/Async_await
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals	https://s3.amazonaws.com/
https://clients2.google.com/service/update2/crx	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd

Raw Manifest

{
  "name": "Fileon - S3 Browser",
  "icons": {
    "16": "brand-icon16.png",
    "32": "brand-icon32.png",
    "48": "brand-icon48.png",
    "128": "brand-icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "brand-icon16.png",
      "32": "brand-icon32.png",
      "48": "brand-icon48.png",
      "128": "brand-icon128.png"
    }
  },
  "version": "1.0.8",
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "Fileon",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "An unified user interface for AWS S3 and other object storages.",
  "host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3
}