[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Eduphoria LockDown Browser

Version 0.4.60 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Rating: 1.5 ★ (48 ratings)

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has extremely poor user trust indicators with only a 1.5-star rating from 48 reviews, suggesting significant user dissatisfaction. The lack of visible developer information and user count raises additional transparency concerns. However, the name suggests it's designed for educational testing environments, which would legitimately require extensive system control.

Concerns:

The permission set is extraordinarily broad and invasive for most use cases. The extension can read browsing history, access all cookies across all websites, intercept and modify web requests, manage other extensions, and read/write clipboard content. The combination of system.display, wallpaper, and management permissions suggests deep system integration that goes far beyond typical browser functionality. The <all_urls> host permission grants access to every website visited. Most concerning is that these permissions collectively enable comprehensive surveillance and control over the user's entire browsing experience.

Recommendations:

Given the critical risk level, only install this extension if specifically required by an educational institution for secure testing. If required, create a dedicated Chrome profile exclusively for testing purposes, disable all other extensions, and avoid any personal browsing in that profile. After testing, immediately remove the extension or delete the entire profile. Never use this extension for general browsing or on a profile containing personal data.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: management

This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

system.display
history
cookies
storage
webNavigation
webRequest
tabs
activeTab
scripting
management
contentSettings
browsingData
declarativeNetRequestWithHostAccess
clipboardRead
clipboardWrite
wallpaper

Host Permissions:

http://*/*
https://*/*
<all_urls>

Embedded URLs (136 total):

https://support.respondus.com/hc/en-us/articles/4416216293659-Chromebook-There-is-a-problem-with-the-URL-for-this-exam	https://web.respondus.com/tou-helpcenter/
https://respondus.knowledgeowl.com/home	https://support.respondus.com/
https://autolaunch.respondus2.com/	https://smc-service-cloud.respondus2.com
https://web.respondus.com/	https://d1hvyp8wapcgir.cloudfront.net
https://d9unvfzorf0bo.cloudfront.net	https://d1hu9sl7n8ouk3.cloudfront.net
https://d1yb8axa7jtm4t.cloudfront.net	https://d3gmpnnqf0pogw.cloudfront.net
https://studymate.com/psm2/sm.do	https://fonts.googleapis.com/css2?family=Open+Sans:wght@400&display=swap
http://www.w3.org/2000/svg	https://fonts.googleapis.com/css?family=Open+Sans
https://fonts.googleapis.com/css?family=Raleway	https://clients2.google.com/service/update2/crx
http://www.apache.org/licenses/	http://www.apache.org/licenses/LICENSE-2.0
http://docs.nwjs.io/en/latest/For%20Users/Advanced/JavaScript%20Contexts%20in%20NW.js/#access-nodejs-and-nwjs-api-in-browser-context	https://www.electronjs.org/docs/api/process#processversionselectron-readonly
https://www.electronjs.org/docs/api/process#processtype-readonly	https://github.com/adobe-webplatform/Snap.svg/blob/b365287722a72526000ac4bfcf0ce4cac2faa015/src/path.js#L852
https://www.w3.org/TR/SVG11/filters.html#feComponentTransferElement	https://developer.mozilla.org/en-US/docs/Web/Accessibility/Understanding_Colors_and_Luminance
https://www.w3.org/TR/WCAG20/#relativeluminancedef	https://bugzilla.mozilla.org/1547776.
https://bugzilla.mozilla.org/1841972	https://code.google.com/p/smhasher/wiki/MurmurHash3.
https://bugzilla.mozilla.org/show_bug.cgi?id=726227	https://bugzilla.mozilla.org/show_bug.cgi?id=664884
https://github.com/Rob--W/open-in-browser/blob/7e2e35a38b8b4e981b11da7b2f01df0149049e92/extension/content-disposition.js	https://github.com/Rob--W/open-in-browser/issues/26
https://bugzil.la/875615	https://searchfox.org/mozilla-central/rev/4a590a5a15e35d88a3b23dd6ac3c471cf85b04a8/netwerk/mime/nsMIMEHeaderParamImpl.cpp#742-748
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.35.2:	https://bugzilla.mozilla.org/show_bug.cgi?id=1719465.
https://rawgit.com/w3c/input-events/v1/index.html#interface-InputEvent-Attributes	https://developer.mozilla.org/en-US/docs/Web/CSS/color_value/color-mix#browser_compatibility
https://fontforge.org/docs/techref/bezier.html#converting-truetype-to-postscript	https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Image_types
https://bugzilla.mozilla.org/show_bug.cgi?id=1908184	https://github.com/mozilla/pdf.js.quickjs/blob/main/src/myjs.js
http://www.xfa.org/schema/xci/	http://www.xfa.org/schema/xfa-connection-set/
http://www.xfa.org/schema/xfa-data/	http://www.xfa.org/schema/xfa-form/
http://www.xfa.org/schema/xfa-locale-set/	http://ns.adobe.com/xdp/pdf/
http://www.w3.org/2000/09/xmldsig#	http://www.xfa.org/schema/xfa-source-set/
http://www.w3.org/1999/XSL/Transform	http://www.xfa.org/schema/xfa-template/
http://www.xfa.org/schema/xdc/	http://ns.adobe.com/xdp/
http://ns.adobe.com/xfdf/	http://www.w3.org/1999/xhtml
http://ns.adobe.com/xmpmeta/	http://www.xfa.org/schema/xfa-data/1.0/
https://developer.mozilla.org/en-US/docs/Web/CSS/string.	https://developer.mozilla.org/en-US/docs/Web/CSS/custom-ident.
https://developer.mozilla.org/en-US/docs/Web/CSS/font-style.	https://developer.mozilla.org/en-US/docs/Web/CSS/font-weight.
http://example.com	http://www.poynton.com/notes/colour_and_gamma/ColorFAQ.html
http://www.brucelindbloom.com/index.html?Eqn_ChromAdapt.html	http://www.brucelindbloom.com/index.html?Eqn_RGB_XYZ_Matrix.html.
http://en.wikipedia.org/wiki/SRGB.	http://www.adobe.com/content/dam/Adobe/en/devnet/photoshop/sdk/
http://www.color.org/srgb.pdf	http://www.jpeg.org/public/fcd15444-1.pdf
https://github.com/notmasteryet/jpgjs.	https://learn.microsoft.com/en-us/typography/opentype/spec/os2#ulunicoderange1-bits-031ulunicoderange2-bits-3263ulunicoderange3-bits-6495ulunicoderange4-bits-96127
https://searchfox.org/mozilla-central/rev/cbdfa503a87597b20719aae5f6a1efccd6cb3b7b/gfx/thebes/gfxHarfBuzzShaper.cpp#251-294	https://github.com/freetype/freetype/blob/edd4fedc5427cf1cf1f4b045e53ff91eb282e9d4/src/truetype/ttgload.c#L1205
https://github.com/freetype/freetype/blob/edd4fedc5427cf1cf1f4b045e53ff91eb282e9d4/src/truetype/ttgload.c#L1209	https://developer.apple.com/fonts/TrueType-Reference-Manual/RM06/Chap6glyf.html
http://www.math.ubc.ca/~cass/piscript/type1.pdf	https://developer.apple.com/fonts/TrueType-Reference-Manual/RM06/Chap6name.html

Page 1 of 2

Raw Manifest

{
  "name": "Eduphoria LockDown Browser",
  "icons": {
    "128": "assets/images/icon.png"
  },
  "action": {
    "default_icon": {
      "128": "assets/images/icon.png"
    },
    "default_popup": "popup.html"
  },
  "author": "SDK_EDUPHORIA_PROD",
  "version": "0.4.60",
  "incognito": "not_allowed",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "LockDown Browser is a custom browser that locks down the exam environment within specific learning and assessment systems",
  "permissions": [
    "system.display",
    "history",
    "cookies",
    "storage",
    "webNavigation",
    "webRequest",
    "tabs",
    "activeTab",
    "scripting",
    "management",
    "contentSettings",
    "browsingData",
    "declarativeNetRequestWithHostAccess",
    "clipboardRead",
    "clipboardWrite",
    "wallpaper"
  ],
  "default_locale": "en",
  "content_scripts": [],
  "host_permissions": [
    "http://*/*",
    "https://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "background.js",
        "manifest.json",
        "viewer.html",
        "viewer.js",
        "toolbar.js",
        "security.js",
        "security.html",
        "calculator.js",
        "create-calculator.js",
        "calculator.html",
        "end-exam.js",
        "end-exam.html",
        "focus-lost.html",
        "monitor.html",
        "monitor.js",
        "loading-bar.html",
        "loading-bar.js",
        "early-exit.html",
        "early-exit.js",
        "essay-block.js",
        "symbol-sheet.html",
        "symbol-sheet.js",
        "create-symbol-sheet.js",
        "_locales/de/messages.json",
        "_locales/en/messages.json",
        "_locales/es/messages.json",
        "_locales/fr/messages.json",
        "_locales/it/messages.json",
        "_locales/pt/messages.json",
        "/assets/images/close-tab.png",
        "/assets/images/calculator-light.png",
        "/assets/images/x-square.png",
        "/assets/images/recording-icon.png",
        "/assets/images/symbol-icon.png"
      ]
    }
  ]
}

by ✦ Astarte

Eduphoria LockDown Browser

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (136 total):

Raw Manifest

Detections

Manifest Findings