[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

WALLIX Vault Password Manager

Version 2025.12.1 View in Chrome Web Store

Last scanned: about 2 months ago | force re-scan

Extension Details

Rating: 4.3 ★

Users: 555

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

WALLIX is a legitimate cybersecurity company specializing in privileged access management solutions. However, this extension has concerning characteristics: extremely low user adoption (only 555 users), missing developer information, and no visible last update date. For a password manager from an established company, these metrics suggest either a very new release or limited market acceptance.

Concerns:

The extension requests an excessive number of high-risk permissions that create significant attack surface. While password managers legitimately need clipboard access for auto-fill functionality and storage permissions for encrypted vault data, several permissions appear unnecessary or overly broad. The webRequest and webNavigation permissions allow complete monitoring of browsing activity. Broad host permissions enable access to all websites, creating potential for credential theft if compromised. The unsafe WebAssembly execution policy is particularly concerning as it could hide malicious code. Content script injection across all sites, while needed for auto-fill, increases exposure to web-based attacks.

Recommendations:

Given the critical risk level, install this extension only in a dedicated Chrome profile isolated from sensitive browsing activities. Verify the extension's authenticity through WALLIX's official website before installation. Consider using established password managers with larger user bases and more transparent development practices. If you must use this extension, regularly audit its permissions and monitor for unusual network activity. Enable Chrome's enhanced protection mode and keep the extension updated to the latest version.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

activeTab
alarms
clipboardRead
clipboardWrite
contextMenus
idle
offscreen
scripting
cookies
storage
tabs
unlimitedStorage
webNavigation
webRequest
webRequestAuthProvider
notifications

Optional Permissions:

nativeMessaging
privacy

Host Permissions:

https://*/*
http://*/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'
sandbox: sandbox allow-scripts; script-src 'self'

Embedded URLs (1063 total):

http://www.w3.org/2000/svg	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
https://wallix.com/help/keyboard-shortcuts	https://wallix.com/help/disable-browser-autofill/
https://github.com/fregante/content-scripts-register-polyfill#permissions	https://wallix.com/help/fingerprint-phrase/
https://app.addy.io	https://quack.duckduckgo.com/api
https://www.fastmail.com/dev/maskedemail	https://api.fastmail.com
https://relay.firefox.com/api	https://api.forwardemail.net
https://app.simplelogin.io	http://www.w3.org/1999/xlink
https://wallix.com/help/attachments/#add-storage-space	https://wallix.com/help/account-encryption-key/#rotate-your-encryption-key
https://vault.wallix.com	https://wallix.com/terms/
https://wallix.com/privacy/	https://wallix.com/email-preferences
https://wallix.com/help/setup-two-step-login/	https://www.google.com/s2/favicons?domain=
https://wallix.com/help/uri-match-detection/	https://wallix.com/help/ssh-agent
https://wallix.com/contact	https://wallix.com/help/website-icons/
https://wallix.com/help/transfer-ownership/	https://google.com
https://lastpass.com	https://graph.microsoft.com
https://content.googleapis.com	https://www.googleapis.com
https://wallix.com/help/export-your-data/	https://wallix.com/help/import-from-lastpass/
https://wallix.com/help/import-from-chrome/	https://wallix.com/help/import-from-firefox/
https://wallix.com/help/import-from-safari/	https://wallix.com/help/import-from-1password/
https://vault.passky.org	https://github.com/spookylukey/gnome-keyring-import-export
https://wallix.com/help/auto-fill-browser/	https://vault.trustelem.com/domains
https://wallix.com/help/blocking-uris/	https://wallix.com/help/phishing-blocked/
https://chromewebstore.google.com/detail/bitwarden-free-password-m/nngceckbapebfimnlniiiahkandclblb/reviews	https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/#reviews
https://addons.opera.com/en/extensions/details/bitwarden-free-password-manager/#feedback-container	https://microsoftedge.microsoft.com/addons/detail/jbkfoedolllekgbhcbcoahefnbanhhlh
https://apps.apple.com/app/bitwarden/id1352778147	https://wallix.com/help/
https://apps.apple.com/app/bitwarden-password-manager/id1137397744	https://play.google.com/store/apps/details?id=com.x8bit.bitwarden
https://wallix.com/download/#downloads-desktop	https://wallix.com/products/business/
https://wallix.com/products/authenticator	https://wallix.com/products/secrets-manager
https://wallix.com/products/passwordless	https://wallix.com/help/wasm-not-supported/
https://api.wallix.com	https://identity.wallix.com
https://icons.bitwarden.net	https://notifications.wallix.com
https://events.wallix.com	https://scim.wallix.com
https://api.bitwarden.eu	https://identity.bitwarden.eu
https://icons.bitwarden.eu	https://vault.bitwarden.eu
https://notifications.bitwarden.eu	https://events.bitwarden.eu
https://scim.bitwarden.eu	https://scim.wallix.com/v2
https://send.wallix.com/#	https://wallix.com/help/kdf-algorithms/
https://api.pwnedpasswords.com/range/	https://github.com/zloirock/core-js/blob/v3.47.0/LICENSE
https://github.com/zloirock/core-js	https://github.com/Foxandxss/angular-toastr/blob/cb508fe6801d6b288d3afc525bb40fee1b101650/dist/angular-toastr.css
https://github.com/FortAwesome/Font-Awesome-Pro/blob/master/advanced-options/raw-svg/regular/info-circle.svg	https://github.com/FortAwesome/Font-Awesome-Pro/blob/master/advanced-options/raw-svg/regular/times-circle.svg

Page 1 of 14

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "16": "images/icon16.png",
    "32": "images/icon32.png",
    "48": "images/icon48.png",
    "96": "images/icon96.png",
    "128": "images/icon128.png"
  },
  "action": {
    "default_icon": {
      "19": "images/icon19.png",
      "38": "images/icon38.png"
    },
    "default_popup": "popup/index.html",
    "default_title": "Wallix"
  },
  "author": "WALLIX",
  "sandbox": {
    "pages": [
      "overlay/menu-button.html",
      "overlay/menu-list.html"
    ]
  },
  "storage": {
    "managed_schema": "managed_schema.json"
  },
  "version": "2025.12.1",
  "commands": {
    "lock_vault": {
      "description": "__MSG_commandLockVaultDesc__"
    },
    "autofill_card": {
      "description": "__MSG_commandAutofillCardDesc__"
    },
    "autofill_login": {
      "description": "__MSG_commandAutofillLoginDesc__",
      "suggested_key": {
        "default": "Ctrl+Shift+L"
      }
    },
    "_execute_action": {
      "description": "__MSG_commandOpenPopup__",
      "suggested_key": {
        "linux": "Ctrl+Shift+U",
        "default": "Ctrl+Shift+Y"
      }
    },
    "autofill_identity": {
      "description": "__MSG_commandAutofillIdentityDesc__"
    },
    "generate_password": {
      "description": "__MSG_commandGeneratePasswordDesc__",
      "suggested_key": {
        "default": "Ctrl+Shift+9"
      }
    }
  },
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "Wallix",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extDesc__",
  "permissions": [
    "activeTab",
    "alarms",
    "clipboardRead",
    "clipboardWrite",
    "contextMenus",
    "idle",
    "offscreen",
    "scripting",
    "cookies",
    "storage",
    "tabs",
    "unlimitedStorage",
    "webNavigation",
    "webRequest",
    "webRequestAuthProvider",
    "notifications"
  ],
  "homepage_url": "https://wallix.com",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content/content-message-handler.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*",
        "file:///*"
      ],
      "all_frames": false,
      "exclude_matches": [
        "*://*/*.xml*",
        "file:///*.xml*"
      ]
    },
    {
      "js": [
        "content/trigger-autofill-script-injection.js"
      ],
      "css": [
        "content/autofill.css"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*",
        "file:///*"
      ],
      "all_frames": true,
      "exclude_matches": [
        "*://*/*.xml*",
        "file:///*.xml*"
      ]
    }
  ],
  "host_permissions": [
    "https://*/*",
    "http://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "nativeMessaging",
    "privacy"
  ],
  "minimum_chrome_version": "102.0",
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'self'",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "content/fido2-page-script.js",
        "notification/bar.html",
        "images/icon38.png",
        "images/icon38_locked.png",
        "overlay/menu-button.html",
        "overlay/menu-list.html",
        "overlay/menu.html",
        "popup/fonts/*"
      ],
      "use_dynamic_url": true
    }
  ]
}

by ✦ Astarte

WALLIX Vault Password Manager

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (1063 total):

Raw Manifest

Detections

Manifest Findings