[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Folio: Manage Real Estate Deals from Gmail

Version 1.3.102 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: Inside Real Estate, LLC

Rating: 4.7 ★ (212 ratings)

Users: 30,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 4 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://apis.google.com/, https://mail.google.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
cookies
scripting

Host Permissions:

https://www.amitree.com/
https://apis.google.com/
https://mail.google.com/*

Content Security Policy:

sandbox: sandbox allow-scripts; script-src 'self'; object-src 'self'

Embedded URLs (802 total):

https://jqueryui.com	https://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url
http://fontawesome.io	http://fontawesome.io/license
https://fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2	https://fonts.gstatic.com/s/materialsymbolsoutlined/v141/kJF1BvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oDMzByHX9rA6RzaxHMPdY43zj-jCxv3fzvRNU22ZXGJpEpjC_1v-p_4MrImHCIJIZrDCvHOej.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKKTU1Kvnz.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKKTU1Kvnz.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKKTU1Kvnz.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKKTU1Kvnz.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKKTU1Kvnz.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4AMP6lbBP.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4AMP6lbBP.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4AMP6lbBP.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4AMP6lbBP.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4AMP6lbBP.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4AMP6lbBP.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4AMP6lbBP.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4AMP6lbBP.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4AMP6lbBP.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4AMP6lbBP.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4AMP6lbBP.woff2	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4AMP6lbBP.woff2
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2	https://pusher.com/
http://js.pusher.com	https://js.pusher.com
https://pusher.com	https://github.com/pusher/pusher-js/tree/cc491015371a4bde5743d1c87a0fbac0feb53195#encrypted-channel-support
http://purl.org/dc/elements/1.1/	http://creativecommons.org/ns#
http://www.w3.org/1999/02/22-rdf-syntax-ns#	http://www.w3.org/2000/svg
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	http://www.inkscape.org/namespaces/inkscape
http://purl.org/dc/dcmitype/StillImage	https://www.amitree.com
https://www.googleadservices.com/pagead/conversion/999678629/?label=i2u0CKnkqmkQpcXX3AM&amp	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/Trim#Polyfill
http://dbj.org/dbj/?p=286	https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js
https://developers.google.com/search/docs/advanced/crawling/overview-google-crawlers	http://dean.edwards.name/weblog/2005/10/add-event/
https://gist.github.com/1930440	http://www.w3.org/TR/css3-selectors/#attribute-selectors
https://developer.samsung.com/internet/user-agent-string-format	http://www.useragentstring.com/pages/useragentstring.php
https://publicsuffix.org/	http://www.cs.rochester.edu/research/synchronization/pseudocode/fastlock.html
https://github.com/wolever	https://gist.github.com/wolever/5fd7573d1ef6166e8f8c4af286a69432.
http://mixpanel.com/	http://documentcloud.github.com/underscore/
http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/	https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
https://api-js.mixpanel.com	https://mixpanel.com
https://cdn.mxpnl.com	https://github.com/mixpanel/mixpanel-js/blob/8b2e1f7b/src/mixpanel-core.js#L87-L110
https://developer.mozilla.org/en-US/docs/Web/API/Window/unload_event#usage_notes.	http://www.ecma-international.org/ecma-262/5.1/#sec-12.4
https://help.mixpanel.com/hc/en-us/articles/360039133851	http://www.w3.org/1999/xlink
https://sketchapp.com	http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
https://stackoverflow.com/q/181348	https://en.wikipedia.org/wiki/ISO_week_date#Calculating_a_date_given_the_year.2C_week_number_and_weekday
http://momentjs.com/guides/#/warnings/define-locale/	https://tools.ietf.org/html/rfc2822#section-3.3
http://momentjs.com/guides/#/warnings/js-date/	https://github.com/moment/moment/issues/1423
http://momentjs.com/guides/#/warnings/min-max/	https://github.com/moment/moment/issues/2978
https://github.com/moment/moment/pull/1871	http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
http://momentjs.com/guides/#/warnings/add-inverted-param/	https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects

Page 1 of 11

Raw Manifest

{
  "name": "Folio: Manage Real Estate Deals from Gmail",
  "icons": {
    "16": "16x16.png",
    "48": "48x48.png",
    "128": "128x128.png"
  },
  "action": {
    "default_title": "Folio"
  },
  "version": "1.3.102",
  "background": {
    "type": "module",
    "service_worker": "assets/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Create and share real estate closing timelines from your Gmail inbox. Integrates seamlessly with Google Drive and Calendar.",
  "permissions": [
    "storage",
    "cookies",
    "scripting"
  ],
  "content_scripts": [
    {
      "js": [
        "assets/vendor.js",
        "assets/folio.js",
        "assets/inject-css.js"
      ],
      "run_at": "document_end",
      "matches": [
        "https://mail.google.com/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "https://www.amitree.com/",
    "https://apis.google.com/",
    "https://mail.google.com/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://www.amitree.com/*"
    ]
  },
  "minimum_chrome_version": "92",
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://mail.google.com/*"
      ],
      "resources": [
        "pageWorld.js",
        "fonts/folio.ttf",
        "assets/*"
      ]
    }
  ]
}

by ✦ Astarte

Folio: Manage Real Estate Deals from Gmail

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (802 total):

Raw Manifest

Detections

Manifest Findings