[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

Ui.Vision

Version 9.5.3 View in Chrome Web Store

Last scanned: 7 months ago | force re-scan

Extension Details

Developer: ui.vision

Rating: 3.9 ★ (219 ratings)

Size: 8.09MiB

Last Updated: March 15, 2025

Users: 100,000

Developer Info: a9t9 software GmbHPostfach 1343 Walldorf 69184 DE

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

- The extension has a relatively large user base of 100,000 users, which could indicate some level of trust and popularity.

- However, the developer information is limited, and the company "a9t9 software GmbH" does not have a well-established reputation.

- The extension's description is missing, which raises some concerns about transparency.

Concerns:

- The extension requests an extensive list of permissions, many of which are considered high-risk and potentially unnecessary for the extension's functionality.

- The broad host permissions (<all_urls>) and content script injection capabilities raise concerns about potential privacy violations and data theft.

- The ability to read and write to the clipboard, access bookmarks, and modify cookies could lead to sensitive data exposure or browser hijacking.

- The debugger permission allows the extension to manipulate other extensions and applications, which could be exploited for malicious purposes.

- The unsafe WebAssembly execution policy increases the risk of hidden malicious code or resource-intensive operations.

Recommendations:

- Exercise extreme caution when installing this extension, as it poses a critical risk to your browser's security and privacy.

- If you must use this extension, consider running it in a separate browser profile or a sandboxed environment to isolate it from your main browsing activities.

- Regularly review the extension's permissions and revoke any unnecessary ones to minimize potential risks.

- Monitor your browser's behavior and uninstall the extension immediately if you notice any suspicious activities or performance issues.

- Consider using alternative extensions from reputable developers with a clear purpose and minimal permissions required.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: bookmarks

This extension has the bookmarks permission. Can access and modify bookmarks. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: debugger

This extension has the debugger permission. Can debug and manipulate other extensions/apps. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: proxy

This extension has the proxy permission. Can control proxy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

bookmarks
clipboardRead
clipboardWrite
cookies
debugger
downloads
downloads.ui
notifications
storage
tabs
activeTab
proxy
nativeMessaging
contextMenus
webRequest
webRequestAuthProvider
sidePanel
scripting

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval';

Embedded URLs (557 total):

https://medium.com/@martin_hotell/improved-redux-type-safety-with-typescript-2-8-2c11a8062575	https://github.com/facebook/regenerator/blob/main/LICENSE
https://stackoverflow.com/questions/6081483/maximum-size-of-a-canvas-element/11585939#11585939	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Interact_with_the_clipboard#Browser-specific_considerations_2
https://bugzilla.mozilla.org/show_bug.cgi?id=1425829	https://github.com/teamdocs/sidebar_uiv/issues/106
https://goto.ui.vision/x/idehelp?help=xclick_updatecheck&xversion=	https://goto.ui.vision/x/idehelp?help=xclick_download
https://goto.ui.vision/x/idehelp?help=xclick	https://goto.ui.vision/x/idehelp?help=xdesktop_updatecheck&xversion=
https://goto.ui.vision/x/idehelp?help=xdesktop_download	https://goto.ui.vision/x/idehelp?help=xdesktop
https://goto.ui.vision/x/idehelp?help=xmodule-ocr_updatecheck&xversion=	https://goto.ui.vision/x/idehelp?help=xmodule-ocr_download
https://goto.ui.vision/x/idehelp?help=xmodule-ocr	http://eligrey.com
https://github.com/eligrey/FileSaver.js/blob/master/LICENSE.md	http://purl.eligrey.com/github/FileSaver.js/blob/master/FileSaver.js
https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=1420419	http://www.w3.org/1999/xhtml
https://developer.apple.com/library/safari/documentation/Tools/Conceptual/SafariExtensionGuide/WorkingwithWindowsandTabs/WorkingwithWindowsandTabs.html	https://www.gamepix.com/play/tic-tac-toe-html5
https://www.theonlinecalculator.com/	https://ui.vision/contact
https://forum.ui.vision/	https://docs.google.com/forms/d/1cbI5dMRs0-t_IwNzPm6T3lAG_nPgsnJZEA-FEYVARxg/
https://ui.vision/rpa/docs/selenium-ide/form-filling	https://ui.vision/demo/webtest/dragdrop/
https://ui.vision/demo/filedownload	https://ui.vision/demo/executescript
https://ui.vision/demo/webtest/frames/	https://ui.vision/blog/
https://ui.vision/demo/executeScript	https://ui.vision/demo/iframes
https://ui.vision/demo/waitforelementvisible	https://ui.vision/demo/webtest/implicitwaiting/
https://ui.vision/demo/csvsave	http://download.ui.vision/demo/pdf-test.pdf
https://ocr.space	https://forum.ui.vision/t/string-search-startswith-and-includes/10081/3
https://ui.vision/demo/draw	https://ui.vision/demo/tabs
https://ui.vision	https://ui.vision/
https://ui.vision/demo/xtype	https://ui.vision/x/desktop-automation#ocr
https://ui.vision/rpa/x/desktop-automation/screen-scraping	https://docs.google.com/forms/d/e/1FAIpQLScGWVjexH2FNzJqPACzuzBLlTWMJHgLUHjxehtU-2cJxtu6VQ/viewform
https://blog.prototypr.io/align-svg-icons-to-text-and-say-goodbye-to-font-icons-d44b3d7b26b4	https://github.com/ant-design/ant-design/blob/master/components/date-picker/locale/example.json
https://stackoverflow.com/a/32749533/1755633	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://goto.ui.vision/x/idehelp?help=relative_clicks
https://drafts.csswg.org/css-values-3/#urls	https://lodash.com/
https://jquery.org/	https://lodash.com/license
http://underscorejs.org/LICENSE	http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring
https://css-tricks.com/debouncing-throttling-explained-examples/	http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types
http://ixti.net/development/javascript/2011/11/11/base64-encodedecode-of-utf8-in-browser-with-js.html	https://tools.ietf.org/html/rfc2315
http://www.requirejs.org/docs/api.html	https://github.com/amdjs/amdjs-api/wiki/AMD
http://www.json.org/JSON_checker/utf8_decode.c	https://goto.ui.vision/x/idehelp?help=k_update
https://goto.ui.vision/x/idehelp?help=k_welcome	https://goto.ui.vision/x/idehelp?help=k_why
https://goto.ui.vision/x/idehelp?help=k_xupgradepro	https://goto.ui.vision/x/idehelp?help=k_xupgrade_contactsupport
https://api.ocr.space/parse/image	https://apipro1.ocr.space/parse/image
https://apipro2.ocr.space/parse/image	https://license1.ocr.space/api/status
https://github.com/teamdocs/selenium-ide-chrome-light-2017/issues/884#issuecomment-1088739538	https://developer.chrome.com/docs/extensions/whatsnew/#m100-native-msg-lifetime
https://goto.ui.vision/x/idehelp?help=xfileaccess_updatecheck&xversion=	https://goto.ui.vision/x/idehelp?help=xfileaccess_download

Page 1 of 7

Raw Manifest

{
  "name": "__MSG_name__",
  "icons": {
    "128": "logo128.png"
  },
  "action": {
    "default_icon": {
      "38": "logo38.png"
    }
  },
  "version": "9.5.3",
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "__MSG_short_name__",
  "side_panel": {
    "default_path": "sidepanel.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "bookmarks",
    "clipboardRead",
    "clipboardWrite",
    "cookies",
    "debugger",
    "downloads",
    "downloads.ui",
    "notifications",
    "storage",
    "tabs",
    "activeTab",
    "proxy",
    "nativeMessaging",
    "contextMenus",
    "webRequest",
    "webRequestAuthProvider",
    "sidePanel",
    "scripting"
  ],
  "options_page": "options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content_script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": true
    }
  ],
  "offline_enabled": true,
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "content_script.js",
        "inject.js",
        "logo.png"
      ],
      "extension_ids": []
    }
  ]
}

by ✦ Astarte

Ui.Vision

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (557 total):

Raw Manifest

Detections

Manifest Findings