[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Dashlane — Password Manager

Version 6.2640.1 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Developer: dashlane.com

Rating: 4.7 ★ (18K ratings)

Users: 1,000,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 9 total findings, including 6 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: privacy

This extension has the privacy permission. Can modify privacy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

contextMenus
cookies
idle
privacy
storage
tabs
unlimitedStorage
scripting
webRequest
declarativeNetRequest
webRequestAuthProvider
alarms

Optional Permissions:

downloads

Host Permissions:

http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'

Embedded URLs (426 total):

https://www.dashlane.com/privacy	https://www.dashlane.com/terms
https://www.dashlane.com/de/privacy	https://www.dashlane.com/de/terms
https://www.dashlane.com/getpremium	https://www.dashlane.com/getfamily
https://www.dashlane.com/business-password-manager/directbuy	https://ws1.dashlane.com/1/teamPlans/confirmFreeTrial?token=
https://check.dashlane.com	https://api.dashlane.com
https://clients2.google.com/service/update2/crx	https://edge.microsoft.com/extensionwebstorebase/v1/crx
http://www.apple.com/DTDs/PropertyList-1.0.dtd	https://share.dashlane.com/
https://app.dashlane.com	https://api.server.staging.dashlane.com/
https://ws1.server.staging.dashlane.com/	https://sso.nitrostaging.dashlane.com/
https://styx.data.dashlane.com	https://static.dashlane.com/runtime-resources/ci/
https://eu.i.posthog.com/i/v0/e/	https://eu.i.posthog.com/flags?v=2&config=false
https://api.dashlane.com/	https://ws1.dashlane.com
https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#	https://example.com
https://johnsmith.io	https://www.icann.org/resources/registries/gtlds/v2/gtlds.json
https://data.iana.org/TLD/tlds-alpha-by-domain.txt	https://web.dev/cross-origin-isolation-guide/
https://sso.nitro.dashlane.com/	https://sso.nitro
https://app.dashlane.com/	https://console.dashlane.com/
https://sso.nitro.dashlane.com/saml/callback	https://sso.nitrostaging.dashlane.com/saml/callback
https://www.dashlane.com/feedback	https://www.npmjs.com/package/react-native-get-random-values.
https://github.com/browserify/crypto-browserify	https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md
https://github.com/date-fns/date-fns/blob/master/docs/upgradeGuide.md#string-arguments	https://docs.nestjs.com/fundamentals/circular-dependency
https://github.com/nestjs/nest/issues/12738	https://redux.js.org/Errors?code=
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/xmlns/
https://xstate.js.org/docs/guides/actions.html	https://github.com/statelyai/xstate/issues
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
http://meyerweb.com/eric/tools/css/reset/	https://developers.google.com/web/updates/2017/11/overscroll-behavior#disableglow
http://www.w3.org/2000/svg%27%3e%3cpath%20d=%27M9.5%200.5L5%205.5L0.5%200.5%27%20stroke=%27%23FFFFFF%27%20stroke-linecap=%27round%27%20stroke-linejoin=%27round%27/%3e%3c/svg%3e	http://commonmark.org/xml/1.0
http://fb.me/use-check-prop-types	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://bit.ly/redux-logger-options	https://fb.me/react-polyfills
https://use.fontawesome.com/7f85a56ba4.css	https://github.com/prerender/prerender
https://www.dashlane.com/pricing-personal	https://www.dashlane.com/account/reset/info
https://accounts.dashlane.com	https://accounts.dashlane.com/payment?app=b2b
https://accounts.dashlane.com/payment?app=b2c	https://console.dashlane.com
https://support.dashlane.com/hc/requests/new?utm_source=extension	https://support.dashlane.com/hc/en-us/articles/202699211
https://support.dashlane.com/hc/en-us/articles/115003111325-I-forgot-my-Master-Password	https://support.dashlane.com/hc/articles/11282971791634
https://support.dashlane.com/hc/articles/6578162476306?utm_medium=misc&utm_source=dashlane_admin_console	https://support.dashlane.com/hc/articles/19810325141266-Credential-Risk-Detection-in-Dashlane
https://support.dashlane.com/hc/articles/23955544757266	https://support.dashlane.com/hc/en-us/articles/12790137108626
https://support.dashlane.com/hc/articles/36604806582034?utm_medium=misc&utm_source=dashlane_admin_console	https://support.apple.com/HT204088
https://support.google.com/store/answer/6160235	https://support.dashlane.com/hc/en-us/articles/360000955925#title2

Page 1 of 6

Raw Manifest

{
  "name": "__MSG_ExtensionName__",
  "icons": {
    "16": "icons/icon-dashlane-16px.png",
    "48": "icons/icon-dashlane-48px.png",
    "128": "icons/icon-dashlane-128px.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/action/icon_loading.png",
      "32": "icons/action/icon_loading@2x.png"
    },
    "default_popup": "popup/index.html",
    "default_title": "Dashlane"
  },
  "storage": {
    "managed_schema": "managed-storage-schema.json"
  },
  "version": "6.2640.1",
  "commands": {
    "_execute_action": {
      "suggested_key": {
        "default": "Ctrl+Shift+L"
      }
    }
  },
  "background": {
    "service_worker": "background-service-worker.js"
  },
  "options_ui": {
    "page": "options/index.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_ExtensionShortDescription__",
  "permissions": [
    "contextMenus",
    "cookies",
    "idle",
    "privacy",
    "storage",
    "tabs",
    "unlimitedStorage",
    "scripting",
    "webRequest",
    "declarativeNetRequest",
    "webRequestAuthProvider",
    "alarms"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content/contentScripts/kwift.CHROME.js",
        "content/injected/vendors.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "exclude_globs": [
        "*://www.google.*/*sourceid=chrome-instant*",
        "*://www.google.*/blank.html*"
      ],
      "exclude_matches": [
        "*://platform.twitter.com/widgets/*",
        "*://www.facebook.com/plugins/*",
        "*://plusone.google.com/_/+1/*",
        "*://challenges.cloudflare.com/*",
        "*://locations.texastechfcu.org/*"
      ],
      "match_about_blank": false
    },
    {
      "js": [
        "content/contentScripts/dashlane-saml-intercept-script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": false
    },
    {
      "js": [
        "content/contentScripts/dashlane-turnstile-bridge.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://check.dashlane.com/*"
      ]
    },
    {
      "js": [
        "content/pageScripts/dashlane-webauthn-page-script.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "https://*/*"
      ],
      "all_frames": true,
      "exclude_globs": [
        "*://www.google.*/*sourceid=chrome-instant*",
        "*://www.google.*/blank.html*"
      ],
      "exclude_matches": [
        "*://platform.twitter.com/widgets/*",
        "*://www.facebook.com/plugins/*",
        "*://plusone.google.com/_/+1/*",
        "*://challenges.cloudflare.com/*",
        "*://locations.texastechfcu.org/*"
      ]
    },
    {
      "js": [
        "content/pageScripts/dashlane-shadow-dom-page-script.js",
        "content/pageScripts/dashlane-top-layer-page-script.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "exclude_globs": [
        "*://www.google.*/*sourceid=chrome-instant*",
        "*://www.google.*/blank.html*"
      ],
      "exclude_matches": [
        "*://platform.twitter.com/widgets/*",
        "*://www.facebook.com/plugins/*",
        "*://plusone.google.com/_/+1/*",
        "*://challenges.cloudflare.com/*",
        "*://locations.texastechfcu.org/*"
      ]
    },
    {
      "js": [
        "content/pageScripts/dashlane-webkit-animation-page-script.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "https://*/*"
      ],
      "all_frames": true,
      "exclude_globs": [
        "*://www.google.*/*sourceid=chrome-instant*",
        "*://www.google.*/blank.html*"
      ],
      "exclude_matches": [
        "*://platform.twitter.com/widgets/*",
        "*://www.facebook.com/plugins/*",
        "*://plusone.google.com/_/+1/*",
        "*://challenges.cloudflare.com/*",
        "*://locations.texastechfcu.org/*"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "downloads"
  ],
  "minimum_chrome_version": "114",
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "resources": [
        "index.html",
        "loading.html",
        "console/index.html",
        "vault/index.html",
        "content/injected/logo-autofill-known.svg",
        "content/injected/logo-autofill-unknown.svg",
        "content/injected/autofill-loader.svg",
        "content/webui/index.html",
        "content/injected/vendors.js",
        "content/pageScripts/dashlane-webauthn-page-script.js",
        "content/pageScripts/dashlane-shadow-dom-page-script.js",
        "content/pageScripts/dashlane-top-layer-page-script.js",
        "content/pageScripts/dashlane-webkit-animation-page-script.js"
      ]
    }
  ]
}

by ✦ Astarte

Dashlane — Password Manager

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (426 total):

Raw Manifest

Detections

Manifest Findings