Extension Details
Context-Aware Verdict
The extension is developed by Synergetic Data Systems, Inc., which appears to be a legitimate company. However, several concerning factors diminish trust: extremely low user adoption with only 424 users, a 0.0 rating with no reviews, and no clear description of what the extension actually does. The name "UnForm Web Extension" suggests it may be related to form processing or document handling, but the vague description provides no clarity on its intended functionality.
The extension requests excessive permissions that seem disproportionate to any reasonable form-processing functionality. The combination of tabs, webNavigation, and <all_urls> permissions creates a powerful surveillance capability that could monitor all browsing activity. The printerProvider permission is particularly unusual for a form-related extension and could potentially be misused. The broad host permissions allow access to sensitive sites including banking, email, and social media platforms. The lack of transparency about the extension's actual purpose, combined with these extensive permissions, raises significant red flags.
Given the high risk profile, avoid installing this extension unless absolutely necessary for business purposes. If required, run it in a completely separate Chrome profile isolated from personal browsing. Contact Synergetic Data Systems directly to understand the extension's specific functionality before installation. Consider alternative form-processing solutions with more transparent permissions and better user reviews. Monitor the extension closely if installed and remove it immediately if any suspicious behavior is detected.
Findings
Security Analysis Details
Required Permissions:
- tabs
- webNavigation
- storage
- printerProvider
- scripting
- alarms
Host Permissions:
- <all_urls>
Content Security Policy:
- extension_pages: script-src 'self'; object-src 'self'
Embedded URLs (82 total):
| http://scripts.sil.org/OFL | http://fortawesome.github.com/Font-Awesome/ | |
| https://materialdesignicons.com/ | https://fonts.google.com/specimen/Roboto | |
| https://webix.com | http://www.w3.org/TR/SVG11/feature#BasicStructure | |
| https://www.w3.org/TR/SVG11/feature#SVG-animation | http://www.w3.org/2000/svg | |
| https://www.particleincell.com/2012/bezier-splines/ | https://developer.mozilla.org/en-US/docs/Web/API/DataTransferItem/webkitGetAsEntry | |
| http://jsperf.com/select-options-vs-innerhtml | http://docs.webix.com/api__refs__ui. | |
| https://jquery.com/ | https://sizzlejs.com/ | |
| https://jquery.org/license | https://github.com/eslint/eslint/issues/6125 | |
| http://jquery.org/license | https://jsperf.com/thor-indexof-vs-for/5 | |
| http://www.w3.org/TR/css3-selectors/#whitespace | http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier | |
| http://www.w3.org/TR/selectors/#attribute-selectors | http://www.w3.org/TR/CSS21/syndata.html#escaped-characters | |
| https://drafts.csswg.org/cssom/#common-serializing-idioms | https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled | |
| https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled | https://html.spec.whatwg.org/multipage/forms.html#category-listed | |
| https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled | https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled | |
| https://bugs.jquery.com/ticket/13378 | https://bugs.jquery.com/ticket/12359 | |
| https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section | http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked | |
| https://bugs.webkit.org/show_bug.cgi?id=136851 | https://github.com/jquery/sizzle/pull/225 | |
| http://www.w3.org/TR/selectors/#pseudo-classes | http://www.w3.org/TR/selectors/#lang-pseudo | |
| http://www.w3.org/TR/selectors/#empty-pseudo | https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx | |
| https://promisesaplus.com/#point-59 | https://promisesaplus.com/#point-48 | |
| https://promisesaplus.com/#point-54 | https://promisesaplus.com/#point-75 | |
| https://promisesaplus.com/#point-64 | https://promisesaplus.com/#point-61 | |
| https://promisesaplus.com/#point-57 | https://bugs.chromium.org/p/chromium/issues/detail?id=378607 | |
| https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click | https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html | |
| https://bugs.chromium.org/p/chromium/issues/detail?id=470258 | https://github.com/eslint/eslint/issues/3229 | |
| https://connect.microsoft.com/IE/feedback/details/1736512/ | https://jsperf.com/getall-vs-sizzle/2 | |
| https://drafts.csswg.org/cssom/#resolved-values | https://developer.mozilla.org/en-US/docs/CSS/display | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=649285 | https://bugzilla.mozilla.org/show_bug.cgi?id=491668 | |
| https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/ | https://html.spec.whatwg.org/multipage/syntax.html#attributes-2 | |
| https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/ | https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespace | |
| https://html.spec.whatwg.org/#strip-and-collapse-whitespace | https://bugzilla.mozilla.org/show_bug.cgi?id=687787 | |
| http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order | https://bugs.chromium.org/p/chromium/issues/detail?id=449857 | |
| http://example.com:80x/ | https://bugs.webkit.org/show_bug.cgi?id=137337 | |
| https://bugs.webkit.org/show_bug.cgi?id=29084 | https://bugs.chromium.org/p/chromium/issues/detail?id=589347 | |
| https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon | https://github.com/jquery/jquery/pull/557 | |
| http://code.google.com/p/stringencoders/source/browse/#svn/trunk/javascript | https://developer.mozilla.org/en/DOM/window.atob | |
| https://developer.mozilla.org/en/DOM/window.btoa | http://mordritch.com/ | |
| http://unform.com | http://cirrusprint.com | |
| https://clients2.google.com/service/update2/crx | https://unform.example.com:27292/arc. | |
| https://cirrusprint.example.com:8483. | https://example.com |
Raw Manifest
{ "name": "UnForm Web Extension", "icons": { "18": "images/uf100ico_18.png", "48": "images/uf100ico_48.png", "128": "images/uf100ico_128.png" }, "action": { "default_icon": { "18": "images/uf100ico_18.png", "48": "images/uf100ico_48.png", "128": "images/uf100ico_128.png" }, "default_title": "UnForm Web Extension" }, "author": "Synergetic Data Systems Inc.", "version": "3.0.8", "background": { "service_worker": "background.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "Web extension for the UnForm document management system", "permissions": [ "tabs", "webNavigation", "storage", "printerProvider", "scripting", "alarms" ], "options_page": "options.html", "host_permissions": [ "<all_urls>" ], "manifest_version": 3, "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'" }, "web_accessible_resources": [ { "matches": [ "<all_urls>" ], "resources": [ "includes/*", "images/*" ] } ] }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.