[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Whatfix for Dotmatics

Version 2023.10.23.1942 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Rating: 4.3 ★

Users: 5

Context-Aware Verdict

HIGH

Overall Risk

Based on 3 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

webNavigation
storage
alarms

Host Permissions:

https://*.whatfix.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (44 total):

https://developer.chrome.com/docs/extensions/reference/alarms/	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://whatfix.com/community/#
https://whatfix.com/terms-services/	https://whatfix.com/privacy-policy/
https://support.whatfix.com/docs/manageextensionsonthewhatfixdashboard	https://support.whatfix.com/docs/triggeringliveinstructionsthroughjavascript
https://support.whatfix.com/docs/multi-languagesupport	https://support.whatfix.com/docs/structureoflanguagepropertyfiles
https://support.whatfix.com/docs/identifyingconditionsforshowingtooltips	https://support.whatfix.com/docs/branchinginawalkthrough
https://support.whatfix.com/docs/whatfixreleasenotes	https://support.whatfix.com/docs/tasklistapi
https://support.whatfix.com/docs/usingvideoplayerparameters	https://support.whatfix.com/docs/selfhelpwidgetapi
https://support.whatfix.com/docs/selfhostingwhatfixcontent	https://support.whatfix.com/x/_gAF
https://support.whatfix.com/docs/usingdynamicurlsforyourflows	https://help.whatfix.com/pages/viewpage.action?pageId=328693
https://support.whatfix.com/docs/downloadexportedflowsfromwhatfixcloudusingwhatfixapi	https://support.whatfix.com/docs/generatingtheapitoken
https://support.whatfix.com/docs/backbuttonforwalkthroughhelptips	https://support.whatfix.com/docs/settingupgoogleanalyticsfromthewhatfixdashboard
https://support.whatfix.com/studio/docs/self-hosting-whatfix-content	https://clients2.google.com/service/update2/crx
https://dotmatics-dev.merck.com/	https://addons.whatfix.com/
https://cdn.whatfix.com/prod/f2a9aaee-7cbf-414e-87ca-f454b8ee94de/content/1698090073229	http://code.google.com/p/google-web-toolkit/issues/detail?id=2079
https://microsoftedge.microsoft.com/addons/detail/	https://chrome.google.com/webstore/detail/
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	https://docs.google.com/document/d/
https://docs.google.com/presentation/d/	https://docs.google.com/spreadsheets/d/
https://drive.google.com/drive/folders/	https://drive.google.com/file/d/
https://www.googleapis.com/auth/drive.metadata.readonly	https://support.beerboard.com/knowledge/what-to-do-when-flowmeter-is-reporting-false-data
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://storage.googleapis.com/leap-np/static/images/loader_darkbg.png
https://www.youtube.com/embed/	https://www.youtube.com/embed/rd_rRTRIBwk?rel=0&autoplay=1&list=

Raw Manifest

{
  "name": "Whatfix for Dotmatics",
  "icons": {
    "16": "logo16.png",
    "19": "logo19.png",
    "32": "logo32.png",
    "38": "logo38.png",
    "48": "logo48.png",
    "128": "logo128.png"
  },
  "action": {
    "browser_action": {
      "default_icon": "logo19.png",
      "default_title": "Whatfix for Dotmatics"
    }
  },
  "version": "2023.10.23.1942",
  "background": {
    "service_worker": "extension.background/extension.background.nocache.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Whatfix provides in-app interactive guides and walkthroughs to Ease User Onboarding, Reduce Training, and Improve Support.",
  "permissions": [
    "webNavigation",
    "storage",
    "alarms"
  ],
  "content_scripts": [
    {
      "js": [
        "extension.foreground/extension.foreground.nocache.js"
      ],
      "matches": [
        "https://dotmatics-dev.merck.com/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "https://*.whatfix.com/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://*.whatfix.com/*/extension/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://dotmatics-dev.merck.com/*"
      ],
      "resources": [
        "whatfix.com/*",
        "config.json"
      ]
    }
  ]
}

by ✦ Astarte

Whatfix for Dotmatics

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (44 total):

Raw Manifest

Detections

Manifest Findings