[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Figma

Version 1.3.24 View in Chrome Web Store

Last scanned: about 14 hours ago

Extension Details

Rating: 4.2 ★ (92 ratings)

Users: 200,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 4 total findings, including 2 high-risk findings.

Findings

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
identity
tabs
unlimitedStorage

Optional Permissions:

scripting
clipboardWrite

Content Security Policy:

extension_pages: default-src 'self'; connect-src https://api.figma.com https://figma.com https://www.figma.com https://*.sentry.io; img-src * data:; style-src 'unsafe-inline'; object-src 'none'

Embedded URLs (188 total):

http://www.example.com	https://sentry.io/welcome/
http://www.w3.org/2000/svg	https://www.figma.com/oauth?
https://api.figma.com/v1/oauth/token	https://api.figma.com/v1/oauth/refresh
https://api.figma.com/v2/files/recent	https://api.figma.com/v2/files/search?query=
https://api.figma.com/v1/files/	https://api.figma.com/v1/files/create?
https://api.figma.com/v1/me	https://www.figma.com/api/figment-proxy/monitor
https://8064e46d30094f82b1834c0682db8f95@o22594.ingest.sentry.io/6617415	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://feross.org	https://github.com/zloirock/core-js/blob/1b944df55282cdc99c90db5f49eb0b6eda2cc0a3/packages/core-js/internals/global.js
https://github.com/getsentry/sentry/blob/master/src/sentry/lang/javascript/processor.py#L67	https://github.com/getsentry/sentry-javascript/pull/8981
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues#typedarray	https://github.com/getsentry/sentry-javascript/issues/8935
http://stackoverflow.com/questions/105034/how-to-create-a-guid-uuid-in-javascript/2117523#2117523	https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
https://developer.mozilla.org/en-US/docs/Web/API/Performance	https://github.com/getsentry/sentry-javascript/issues/2590
https://github.com/mdn/content/issues/4713	https://dev.to/noamr/when-a-millisecond-is-not-a-millisecond-3h6
https://github.com/getsentry/sentry-javascript/issues/2590.	https://www.w3.org/TR/baggage/#limits
https://docs.sentry.io/platforms/javascript/best-practices/multiple-sentry-instances/	https://docs.sentry.io/platforms/javascript/best-practices/browser-extensions/
https://github.com/getsentry/sentry-javascript/blob/develop/MIGRATION.md#deprecate-hub	https://github.com/getsentry/sentry-javascript/issues/2286
https://github.com/getsentry/sentry-javascript/issues/5459	https://github.com/getsentry/sentry-javascript/issues/7813
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/AggregateError	https://github.com/getsentry/sentry-javascript/issues/2572.
https://github.com/getsentry/sentry-javascript/issues/4642	https://developer.mozilla.org/en-US/docs/Web/API/Headers/get
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/FinalizationRegistry	https://develop.sentry.dev/sdk/metrics
https://github.com/getsentry/sentry-javascript/issues/1168	https://github.com/getsentry/sentry/blob/9f08305e09866c8bd6d0c24f5b0aabdd7dd6c59c/src/sentry/lang/javascript/errormapping.py#L83-L108
https://github.com/getsentry/sentry-javascript/issues/1949	https://developer.mozilla.org/en-US/docs/Web/API/DOMError
https://developer.mozilla.org/en-US/docs/Web/API/DOMException	https://webidl.spec.whatwg.org/#es-DOMException-specialness
https://github.com/getsentry/sentry-javascript/pull/7404	https://github.com/getsentry/sentry-javascript/pull/4196
https://caniuse.com/#feat=referrer-policy	https://github.com/getsentry/raven-js/issues/1233
https://fetch.spec.whatwg.org/#http-network-or-cache-fetch	https://github.com/getsentry/sentry-javascript/pull/7553
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/readyState	https://github.com/getsentry/sentry-javascript/issues/6880
https://github.com/angular/angular.js/pull/13945/files	https://github.com/getsentry/sentry-javascript/issues/3344
https://github.com/bugsnag/bugsnag-js/issues/469	https://github.com/getsentry/sentry-javascript/issues/838
https://tools.ietf.org/html/rfc3986#appendix-B	https://develop.sentry.dev/sdk/data-handling/#structuring-data
https://developer.mozilla.org/en-US/docs/Web/API/PromiseRejectionEvent	https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent
https://github.com/getsentry/sentry-javascript/issues/2380	https://github.com/alangpierce/sucrase
https://github.com/alangpierce/sucrase/blob/265887868966917f3b924ce38dfad01fbab1329f/src/transformers/OptionalChainingNullishTransformer.ts#L15	https://github.com/GoogleChrome/web-vitals/issues/14
https://www.apache.org/licenses/LICENSE-2.0	https://web.dev/responsiveness/
https://web.dev/inp/#what-is-a-good-inp-score	https://developer.chrome.com/blog/page-lifecycle-api/#advice-hidden
https://web.dev/inp/#what	https://web.dev/lcp/
https://github.com/GoogleChrome/web-vitals/issues/75	https://web.dev/time-to-first-byte/
https://w3c.github.io/navigation-timing/	https://www.w3.org/TR/hr-time-2/#sec-time-origin
https://web.dev/ttfb/#what-is-a-good-ttfb-score	https://github.com/GoogleChrome/web-vitals/issues/137
https://github.com/GoogleChrome/web-vitals/issues/162	https://web.dev/cls/

Page 1 of 3

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvlsRg8pWPXJQgh8gRGpbOxg01JDbMxF1oFtDM5KYtAG1aQ7Fw1WGSvWwcWGgZtGQ28eXZ5rnD/Eh+tCnYx13SoeZosbP8UKzDR8ZdMYiA6mp6VbksB9ulME5SyBgrRU9m/oxoiULkr8tsAhlbfRi5g45Jpxd/V7cwWC8YVEcbjmtqiZt15alExfIQZ9D2CQVphMQcvHGgMcstYao5c+ciGGqeASdbL5U87B09lpEEUHXpXZWpzDq7DP21PxaLFpgE+EcoNwBVDZdND9dPwRgBwSmRB1ybaut/5QWo85YtN2l3TgDcA5SeO9jTXzC2QNdfLGi3J1LdTNMlpRhgVarDQIDAQAB",
  "name": "Figma",
  "icons": {
    "16": "icon16.png",
    "32": "icon32.png",
    "48": "icon48.png",
    "128": "icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.png",
      "32": "icon32.png",
      "128": "icon128.png"
    }
  },
  "version": "1.3.24",
  "commands": {
    "capture_page": {
      "description": "Capture page"
    },
    "select_element": {
      "description": "Select and capture element"
    }
  },
  "background": {
    "service_worker": "js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Figma",
  "permissions": [
    "storage",
    "identity",
    "tabs",
    "unlimitedStorage"
  ],
  "options_page": "options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/vendor.js",
        "js/content_script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://www.google.com/calendar/*",
        "https://calendar.google.com/calendar/*"
      ]
    },
    {
      "js": [
        "js/vendor.js",
        "js/figma_content_script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://figma.com/*",
        "https://staging.figma.com/*",
        "https://local.figma.engineering:8443/*",
        "https://gov.figma.com/*"
      ]
    }
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "scripting",
    "clipboardWrite"
  ],
  "minimum_chrome_version": "116",
  "content_security_policy": {
    "extension_pages": "default-src 'self'; connect-src https://api.figma.com https://figma.com https://www.figma.com https://*.sentry.io; img-src * data:; style-src 'unsafe-inline'; object-src 'none'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://www.google.com/*",
        "https://calendar.google.com/*"
      ],
      "resources": [
        "img/*.png",
        "font/*.woff2",
        "file_picker.html"
      ]
    }
  ],
  "optional_host_permissions": [
    "<all_urls>"
  ]
}

by ✦ Astarte

Figma

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Content Security Policy:

Embedded URLs (188 total):

Raw Manifest

Detections

Manifest Findings