[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

vCastSender

Version 1.0.0710 View in Chrome Web Store

Last scanned: 21 days ago | force re-scan

Extension Details

Rating: 5.0 ★ (1 rating)

Users: 80,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a concerning trust profile with 80,000 users but only 1 rating review, which is unusual and suggests potential artificial inflation. The perfect 5.0 rating from a single review lacks credibility. The missing author and developer information raises significant transparency concerns, making it difficult to verify the extension's legitimacy or contact the developer for support.

Concerns: The combination of desktopCapture, system.display permissions, and broad host permissions (*://*/) creates a particularly risky scenario. While desktopCapture is reasonable for a casting application, the universal host permissions allow the extension to access and potentially intercept data from every website you visit. This creates opportunities for credential theft, session hijacking, and comprehensive browsing surveillance. The storage permission, while common, adds to the risk by allowing persistent data collection.

Recommendations: Given the high risk level, consider running this extension in a separate Chrome profile dedicated solely to casting activities. Before installation, verify the extension's legitimacy through official app stores or the developer's website. Monitor your system for unusual network activity after installation. Consider using established alternatives from reputable developers with transparent contact information and substantial user feedback. If you must use this extension, disable it when not actively casting and regularly review what data it may have stored.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

desktopCapture
storage
system.display

Host Permissions:

*://*/

Embedded URLs (16 total):

https://clients2.google.com/service/update2/crx	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://sketchapp.com%20--%3e%3ctitle%3estopmirror_normal%3c/title%3e%3cdesc%3eCreated%20with%20Sketch.%3c/desc%3e%3cg%20id=
https://sketchapp.com%20--%3e%3ctitle%3estopmirror_pressed%3c/title%3e%3cdesc%3eCreated%20with%20Sketch.%3c/desc%3e%3cg%20id=	https://sketchapp.com%20--%3e%3ctitle%3epause_normal%3c/title%3e%3cdesc%3eCreated%20with%20Sketch.%3c/desc%3e%3cg%20id=
https://sketchapp.com%20--%3e%3ctitle%3epause_pressed%3c/title%3e%3cdesc%3eCreated%20with%20Sketch.%3c/desc%3e%3cg%20id=	https://sketchapp.com%20--%3e%3ctitle%3eplay_normal%3c/title%3e%3cdesc%3eCreated%20with%20Sketch.%3c/desc%3e%3cg%20id=
https://sketchapp.com%20--%3e%3ctitle%3eplay_pressed%3c/title%3e%3cdesc%3eCreated%20with%20Sketch.%3c/desc%3e%3cg%20id=	https://vuejs.org/error-reference/#runtime-
http://www.w3.org/1998/Math/MathML	https://feross.org/opensource
https://feross.org	https://github.com/legokichi/ts-ebml.git
https://github.com/legokichi/ts-ebml/issues	https://github.com/legokichi/ts-ebml#readme

Raw Manifest

{
  "name": "vCastSender",
  "icons": {
    "16": "src/assets/images/appicon_16.png",
    "32": "src/assets/images/appicon_32.png",
    "48": "src/assets/images/appicon_48.png",
    "128": "src/assets/images/appicon_128.png"
  },
  "action": {
    "default_icon": {
      "16": "src/assets/images/appicon_16.png",
      "32": "src/assets/images/appicon_32.png",
      "48": "src/assets/images/appicon_48.png",
      "128": "src/assets/images/appicon_128.png"
    }
  },
  "author": "IQ",
  "version": "1.0.0710",
  "background": {
    "type": "module",
    "service_worker": "service-worker-loader.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "vCastSender",
  "permissions": [
    "desktopCapture",
    "storage",
    "system.display"
  ],
  "default_locale": "en",
  "host_permissions": [
    "*://*/"
  ],
  "manifest_version": 3
}

by ✦ Astarte