[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

Ui.Vision

Version 10.0.105 View in Chrome Web Store

Last scanned: 15 days ago | force re-scan

Extension Details

Developer: ui.vision

Rating: 3.9 ★ (240 ratings)

Users: 200,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 16 total findings, including 12 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: bookmarks

This extension has the bookmarks permission. Can access and modify bookmarks. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: debugger

This extension has the debugger permission. Can debug and manipulate other extensions/apps. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: proxy

This extension has the proxy permission. Can control proxy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

bookmarks
clipboardRead
clipboardWrite
cookies
debugger
downloads
downloads.ui
notifications
storage
tabs
activeTab
proxy
nativeMessaging
contextMenus
webRequest
webRequestAuthProvider
sidePanel
scripting

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval';

Embedded URLs (192 total):

http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://go.ui.vision/?help=relative_clicks	https://go.ui.vision/?help=aiprovider
https://go.ui.vision/?help=apiprogetkey	https://go.ui.vision/?help=mcp
https://go.ui.vision/?help=aiprompt	https://ui.vision/rpa
https://go.ui.vision/?help=website_whitelist	https://go.ui.vision/?help=cmdline
https://go.ui.vision/?help=bkup_import	https://go.ui.vision/?help=storage_mode
https://go.ui.vision/?help=darkmode	https://go.ui.vision/?help=ocr-local
https://go.ui.vision/?help=ocr-request	https://go.ui.vision/?help=free-ocr-api
https://go.ui.vision/?help=ocrlanguage	https://go.ui.vision/?help=ocrengine
http://0.0.0.0:1234	https://go.ui.vision/?cmd=setproxy
https://go.ui.vision/?help=command_interval	https://go.ui.vision/?help=timeout_pageload
https://go.ui.vision/?help=timeout_wait	https://go.ui.vision/?help=timeout_macro
https://go.ui.vision/?help=timeout_download	https://go.ui.vision/?help=encryption
https://go.ui.vision/?help=encrypt	https://openrouter.ai/api/v1
https://ai.ui.vision/v1	https://go.ui.vision/?help=k_update
https://go.ui.vision/?help=k_welcome	https://go.ui.vision/?help=k_why
https://go.ui.vision/?help=k_xupgradepro	https://go.ui.vision/?help=k_xupgrade_contactsupport
https://api.ocr.space/parse/image	https://apipro1.ocr.space/parse/image
https://apipro2.ocr.space/parse/image	https://license1.ocr.space/api/status
https://go.ui.vision/?help=xfileaccess_updatecheck&xversion=	https://go.ui.vision/?help=xfileaccess_download
https://go.ui.vision/?help=xfileaccess	https://cdn.jsdelivr.net/npm/tesseract.js@v
https://ui.vision/rpa/docs#cmd	http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
http://www.w3.org/1999/xhtml	http://selenium-ide.openqa.org/profiles/test-case
https://go.ui.vision/?help=firefox_access_data_permission	https://go.ui.vision/?help=error101
https://go.ui.vision/?help=error120	https://go.ui.vision/?help=error121
https://go.ui.vision/?help=error179	https://go.ui.vision/?help=error220
https://go.ui.vision/?help=visual	https://go.ui.vision/?help=internalvars
https://go.ui.vision/?cmd=	https://go.ui.vision/?help=home
https://go.ui.vision/?help=ai	https://go.ui.vision/?help=ocr
https://go.ui.vision/?help=forum	https://go.ui.vision/?help=github
https://ui.vision/	https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE
http://foo.com	http://foo.com/
http://babeljs.io/docs/plugins/external-helpers/	http://babeljs.io/docs/plugins/transform-react-jsx/
http://babeljs.io/docs/plugins/#modules	http://babeljs.io/docs/plugins/preset-react/
http://babeljs.io/docs/plugins/#presets	https://babeljs.io/docs/en/babel-core/#options
https://babeljs.io/docs/en/options#filename	https://github.com/thlorenz/convert-source-map#upgrading
https://github.com/babel/babel/tree/main/packages/babel-plugin-syntax-async-do-expressions	https://github.com/babel/babel/tree/main/packages/babel-plugin-syntax-decimal
https://github.com/babel/babel/tree/main/packages/babel-plugin-syntax-decorators	https://github.com/babel/babel/tree/main/packages/babel-plugin-proposal-decorators
https://github.com/babel/babel/tree/main/packages/babel-plugin-syntax-do-expressions	https://github.com/babel/babel/tree/main/packages/babel-plugin-proposal-do-expressions
https://github.com/babel/babel/tree/main/packages/babel-plugin-syntax-export-default-from	https://github.com/babel/babel/tree/main/packages/babel-plugin-proposal-export-default-from

Page 1 of 3

Raw Manifest

{
  "name": "__MSG_name__",
  "icons": {
    "128": "logo128.png"
  },
  "action": {
    "default_icon": {
      "38": "logo38.png"
    }
  },
  "version": "10.0.105",
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "__MSG_short_name__",
  "side_panel": {
    "default_path": "sidepanel.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "bookmarks",
    "clipboardRead",
    "clipboardWrite",
    "cookies",
    "debugger",
    "downloads",
    "downloads.ui",
    "notifications",
    "storage",
    "tabs",
    "activeTab",
    "proxy",
    "nativeMessaging",
    "contextMenus",
    "webRequest",
    "webRequestAuthProvider",
    "sidePanel",
    "scripting"
  ],
  "options_page": "options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content_script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": true
    }
  ],
  "offline_enabled": true,
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "content_script.js",
        "inject.js",
        "logo.png"
      ],
      "extension_ids": []
    }
  ]
}

by ✦ Astarte

Ui.Vision

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (192 total):

Raw Manifest

Detections

Manifest Findings