[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

OneNote Web Clipper

Version 3.11.2 View in Chrome Web Store

Last scanned: about 15 hours ago

Extension Details

Developer: Microsoft Corporation

Rating: 4.8 ★ (68.5K ratings)

Users: 900,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 6 total findings, including 4 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

Security Analysis Details

Required Permissions:

activeTab
scripting
contextMenus
tabs
webRequest
webNavigation
offscreen

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (153 total):

https://us.pipe.aria.microsoft.com/Collector/3.0/	https://de.pipe.aria.microsoft.com/Collector/3.0/
https://au.pipe.aria.microsoft.com/Collector/3.0/	https://jp.pipe.aria.microsoft.com/Collector/3.0/
https://eu.pipe.aria.microsoft.com/Collector/3.0/	https://chrome.google.com/webstore/detail/onenote-web-clipper/gojbdfnpnhogfdgjbigejoaolejmgdhk/reviews
https://microsoftedge.microsoft.com/addons/detail/onenote-web-clipper/oogbnpmeihfgnccdnmmlgicknopghhma?refid=bingshortanswersdownload	https://addons.mozilla.org/en-US/firefox/addon/onenote-clipper/reviews/add
https://www.onenote.com	https://support.microsoft.com/en-us/office/getting-started-with-the-onenote-web-clipper-5696609d-c5ae-4591-b3af-1f897cb6eda6
https://feedbackportal.microsoft.com/feedback/post/c06dcc30-2e1c-ec11-b6e7-0022481f8472	https://login.live.com
https://login.microsoftonline.com	https://odc.officeapps.live.com/odc/v2.1/federationprovider
https://browser.pipe.aria.microsoft.com/Collector/3.0/	http://www.w3.org/1999/xhtml
https://www.onenote.com/api/v1.0/me/notes	http://www.w3.org/2000/svg
https://clients2.google.com/service/update2/crx	https://onenote.officeapps.live.com/
https://ppc-onenote.officeapps.live.com/	https://onenote.officeapps-df.live.com/
https://onenote.officeapps.live-int.com/	http://www.apache.org/licenses/LICENSE-2.0
https://tc39.es/ecma262/#sec-array.prototype-@@unscopables	https://tc39.es/ecma262/#sec-array.prototype.includes
https://tc39.es/ecma262/#sec-array.prototype.indexof	https://tc39.es/ecma262/#sec-createiterresultobject
https://github.com/zloirock/core-js/issues/1128	https://github.com/zloirock/core-js/issues/1130
https://tc39.es/ecma262/#sec-getiteratordirect	https://tc39.es/ecma262/#sec-getmethod
https://tc39.es/proposal-set-methods/#sec-getsetrecord	https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
https://tc39.es/ecma262/#sec-hasownproperty	https://github.com/mozilla/rhino/issues/346
https://tc39.es/ecma262/#sec-isarray	https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
https://tc39.es/ecma262/#sec-iscallable	https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot-aec
https://issues.chromium.org/issues/336839115	https://github.com/tc39/ecma262/pull/3467
https://bugs.webkit.org/show_bug.cgi?id=291195	https://tc39.es/ecma262/#sec-%iteratorprototype%-object
https://tc39.es/ecma262/#sec-%iteratorprototype%-@@iterator	https://tc39.es/ecma262/#sec-lengthofarraylike
https://tc39.es/ecma262/#sec-math.trunc	https://tc39.es/ecma262/#sec-newpromisecapability
https://github.com/zloirock/core-js/issues/475	https://github.com/es-shims/es5-shim/issues/150
https://github.com/kitcambridge/es5-shim/commit/4f738ac066346	https://tc39.es/ecma262/#sec-object.create
https://tc39.es/ecma262/#sec-object.defineproperties	https://tc39.es/ecma262/#sec-object.defineproperty
https://tc39.es/ecma262/#sec-object.getownpropertydescriptor	https://tc39.es/ecma262/#sec-object.getownpropertynames
https://tc39.es/ecma262/#sec-object.getprototypeof	https://tc39.es/ecma262/#sec-object.keys
https://tc39.es/ecma262/#sec-object.prototype.propertyisenumerable	https://tc39.es/ecma262/#sec-object.setprototypeof
https://tc39.es/ecma262/#sec-ordinarytoprimitive	https://tc39.es/ecma262/#sec-requireobjectcoercible
https://tc39.es/ecma262/#sec-set.prototype.difference	https://tc39.es/ecma262/#sec-set.prototype.intersection
https://tc39.es/ecma262/#sec-set.prototype.isdisjointfrom	https://tc39.es/ecma262/#sec-set.prototype.issubsetof
https://tc39.es/ecma262/#sec-set.prototype.issupersetof	https://github.com/tc39/proposal-set-methods/pull/88
https://bugs.webkit.org/show_bug.cgi?id=272679	https://issues.chromium.org/issues/351332634
https://bugs.webkit.org/show_bug.cgi?id=289430	https://tc39.es/ecma262/#sec-set.prototype.symmetricdifference
https://tc39.es/ecma262/#sec-set.prototype.union	https://github.com/zloirock/core-js/blob/v3.49.0/LICENSE
https://github.com/zloirock/core-js	https://github.com/zloirock/core-js/issues/679
https://tc39.es/ecma262/#sec-tobigint	https://tc39.es/ecma262/#sec-toindex
https://tc39.es/ecma262/#sec-tointegerorinfinity	https://tc39.es/ecma262/#sec-tolength

Page 1 of 2

Raw Manifest

{
  "name": "OneNote Web Clipper",
  "icons": {
    "16": "icons/icon-16.png",
    "19": "icons/icon-19.png",
    "32": "icons/icon-32.png",
    "38": "icons/icon-38.png",
    "48": "icons/icon-48.png",
    "64": "icons/icon-64.png",
    "96": "icons/icon-96.png",
    "128": "icons/icon-128.png",
    "256": "icons/icon-256.png"
  },
  "action": {
    "default_icon": {
      "19": "icons/icon-19.png",
      "38": "icons/icon-38.png"
    },
    "default_title": "OneNote Web Clipper"
  },
  "version": "3.11.2",
  "background": {
    "type": "module",
    "service_worker": "chromeExtension.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "activeTab",
    "scripting",
    "contextMenus",
    "tabs",
    "webRequest",
    "webNavigation",
    "offscreen"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "appendIsInstalledMarker.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://onenote.officeapps.live.com/*",
        "https://ppc-onenote.officeapps.live.com/*",
        "https://onenote.officeapps-df.live.com/*",
        "https://onenote.officeapps.live-int.com/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "94",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

by ✦ Astarte

OneNote Web Clipper

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (153 total):

Raw Manifest

Detections

Manifest Findings