[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

RefAssured Connect

Version 1.37.4 View in Chrome Web Store

Last scanned: about 11 hours ago

Extension Details

Developer: https://www.refassured.com/

Rating: 4.6 ★

Users: 735

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 3 total findings, including 1 high-risk finding.

Findings

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
activeTab
storage

Embedded URLs (82 total):

https://stackoverflow.com/questions/72494154/a-listener-indicated-an-asynchronous-response-by-returning-true-but-the-messag	https://raw.github.com/taye/interact.js/main/LICENSE
https://developer.mozilla.org/en-US/docs/Web/API/MouseEvent/buttons#Return_value	https://github.com/taye/interact.js/issues/114
https://github.com/taye/interact.js/issues/703#issuecomment-471570492	https://clients2.google.com/service/update2/crx
https://app-dev.refassured.com/	https://app.refassured.com/
https://npms.io/search?q=ponyfill.	https://app.refassured.com/plugin_domains.json
https://lodash.com/	https://openjsf.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
http://ecma-international.org/ecma-262/7.0/#sec-patterns	http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components
https://en.wikipedia.org/wiki/Combining_Diacritical_Marks	https://en.wikipedia.org/wiki/Combining_Diacritical_Marks_for_Symbols
https://mathiasbynens.be/notes/javascript-unicode	http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero
https://bugs.webkit.org/show_bug.cgi?id=156034	https://en.wikipedia.org/wiki/Exponentiation_by_squaring
https://mdn.io/clearTimeout	https://github.com/jashkenas/underscore/pull/1247
https://bugs.chromium.org/p/v8/issues/detail?id=90	http://ecma-international.org/ecma-262/7.0/#sec-ecmascript-function-objects-call-thisargument-argumentslist
https://es5.github.io/#x13.2.2	https://mdn.io/round#Examples
http://www.ecma-international.org/ecma-262/7.0/#sec-regexp.prototype.tostring	http://ecma-international.org/ecma-262/7.0/#sec-object.keys
https://bugs.chromium.org/p/v8/issues/detail?id=2070	https://mdn.io/setTimeout
https://mdn.io/Array/reverse	https://mdn.io/Array/slice
https://en.wikipedia.org/wiki/Symmetric_difference	https://mdn.io/iteration_protocols#iterator
https://en.wikipedia.org/wiki/Empty_set	https://en.wikipedia.org/wiki/Vacuous_truth
https://en.wikipedia.org/wiki/Fisher-Yates_shuffle	http://peter.michaux.ca/articles/lazy-function-definition-pattern
https://css-tricks.com/debouncing-throttling-explained-examples/	http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object
https://mdn.io/rest_parameters	http://www.ecma-international.org/ecma-262/7.0/#sec-function.prototype.apply
https://mdn.io/spread_operator	https://mdn.io/Structured_clone_algorithm
https://mdn.io/Number/isFinite	https://mdn.io/Number/isInteger
http://ecma-international.org/ecma-262/7.0/#sec-tolength	http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types
https://mdn.io/Number/isNaN	https://mdn.io/isNaN
https://www.npmjs.com/package/babel-polyfill	https://mdn.io/Number/isSafeInteger
http://www.ecma-international.org/ecma-262/7.0/#sec-tointeger	https://mdn.io/Object/assign
https://en.wikipedia.org/wiki/CamelCase	https://en.wikipedia.org/wiki/Latin-1_Supplement_
https://en.wikipedia.org/wiki/Latin_Extended-A	https://mths.be/he
https://mathiasbynens.be/notes/ambiguous-ampersands	http://wonko.com/post/html-escaping
https://en.wikipedia.org/wiki/Letter_case#Special_case_styles	https://es5.github.io/#x15.1.2.2
https://mdn.io/String/replace	https://en.wikipedia.org/wiki/Snake_case
https://mdn.io/String/split	https://en.wikipedia.org/wiki/Letter_case#Stylistic_or_specialised_usage
http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl	https://lodash.com/custom-builds
https://developer.chrome.com/extensions/sandboxingEval	http://ejohn.org/blog/javascript-micro-templating/
https://github.com/olado/doT	https://mdn.io/toLowerCase
https://mdn.io/toUpperCase	http://requirejs.org/docs/errors.html#mismatch
https://github.com/tc39/proposal-global	https://app-dev.refassured.com/plugin_domains_local.json

Page 1 of 2

Raw Manifest

{
  "name": "RefAssured Connect",
  "icons": {
    "16": "assets/icon16.png",
    "32": "assets/icon32.png",
    "48": "assets/icon48.png",
    "128": "assets/icon128.png"
  },
  "action": {},
  "version": "1.37.4",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "RefAssured Connect integrates with your ATS, ensuring you can start, view, and manage your reference checks from anywhere!",
  "permissions": [
    "tabs",
    "activeTab",
    "storage"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://localhost:4201/*",
      "https://app-dev.refassured.com/*",
      "https://app.refassured.com/*"
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://*/*",
        "http://*/*"
      ],
      "resources": [
        "popup.html"
      ]
    }
  ]
}

by ✦ Astarte

RefAssured Connect

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (82 total):

Raw Manifest

Detections

Manifest Findings