[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

improver

Version 5.1 View in Chrome Web Store

Last scanned: about 6 hours ago

Extension Details

Developer: improver.io

Rating: 4.4 ★ (34 ratings)

Users: 9,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has a moderate user base of 9,000 users and a solid 4.4-star rating from 34 reviews, suggesting generally positive user experiences. The developer domain "improver.io" appears to be purpose-built for this extension, though limited information is available about the company's reputation or track record.

Concerns:

The extension's risk profile is elevated due to several concerning factors. The tabs permission combined with broad host permissions creates a powerful combination that could be exploited for malicious purposes. While the extension only requests access to LinkedIn and its own domain, the tabs permission allows it to potentially access information from all browser tabs, not just those it has explicit host permissions for. The lack of a detailed description makes it difficult to assess whether these permissions are justified for the extension's intended functionality. The relatively small number of ratings (34) compared to users (9,000) suggests limited user engagement or feedback.

Recommendations:

Consider running this extension in a separate Chrome profile to isolate potential risks from your main browsing activities. Before installation, research the specific functionality this extension provides to determine if the requested permissions are necessary. Monitor the extension's behavior closely after installation, particularly its interaction with LinkedIn and other tabs. Consider alternatives with more transparent descriptions and established developer reputations if available for your use case.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://*.linkedin.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "improver",
  "icons": {
    "16": "images/icons/16.png",
    "32": "images/icons/32.png",
    "48": "images/icons/48.png",
    "64": "images/icons/64.png",
    "128": "images/icons/128.png"
  },
  "action": {
    "default_icon": {
      "19": "images/icons/19.png",
      "38": "images/icons/38.png"
    },
    "default_title": "improver"
  },
  "version": "5.1",
  "background": {
    "service_worker": "js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_app_description__",
  "permissions": [
    "tabs",
    "storage"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "/js/functions.js",
        "/js/template.js",
        "/js/content.js"
      ],
      "css": [
        "css/styles.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "*://*.linkedin.com/*"
      ]
    },
    {
      "js": [
        "/js/token.js"
      ],
      "matches": [
        "*://*.improver.io/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*.improver.io/*",
    "*://*.linkedin.com/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte

https://clients2.google.com/service/update2/crx	https://www.improver.io
https://improver.io/ext/?	https://improver.io/
https://static.licdn-ei.com/scds/common/u/images/themes/katy/ghosts/person/ghost_person_200x200_v1.png	https://www.linkedin.com/voyager/api/identity/normalizedProfiles/

improver

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (6 total):

Raw Manifest

Detections

Manifest Findings