[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Smartling Context Capture

Version 5.1.2 View in Chrome Web Store

Last scanned: about 22 hours ago

Extension Details

Rating: 4.5 ★ (15 ratings)

Users: 1,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 8 total findings, including 5 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe JavaScript Evaluation

This extension's Content Security Policy allows 'unsafe-eval', which permits dynamic JavaScript code execution using eval() and similar functions. This is a significant security risk as it could allow execution of malicious code.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

identity
activeTab
tabs
pageCapture
storage
contextMenus
scripting
userScripts

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self';
sandbox: sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';

Embedded URLs (796 total):

http://underscorejs.org	https://github.com/allmarkedup/jQuery-URL-Parser
https://github.com/allmarkedup/jQuery-URL-Parser/blob/master/LICENSE	https://jquery.com/
https://sizzlejs.com/	https://jquery.org/license
https://github.com/whatwg/html/issues/2369	https://html.spec.whatwg.org/#nonce-attributes
https://js.foundation/	https://jsperf.com/thor-indexof-vs-for/5
http://www.w3.org/TR/css3-selectors/#whitespace	https://www.w3.org/TR/css-syntax-3/#ident-token-diagram
http://www.w3.org/TR/selectors/#attribute-selectors	http://www.w3.org/TR/CSS21/syndata.html#escaped-characters
https://drafts.csswg.org/cssom/#common-serializing-idioms	https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled	https://html.spec.whatwg.org/multipage/forms.html#category-listed
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
https://bugs.jquery.com/ticket/4833	https://bugs.jquery.com/ticket/13378
https://bugs.jquery.com/ticket/12359	https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section
http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked	https://bugs.webkit.org/show_bug.cgi?id=136851
https://github.com/jquery/sizzle/pull/225	http://www.w3.org/TR/selectors/#pseudo-classes
http://www.w3.org/TR/selectors/#lang-pseudo	http://www.w3.org/TR/selectors/#empty-pseudo
https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx	https://promisesaplus.com/#point-59
https://promisesaplus.com/#point-48	https://promisesaplus.com/#point-54
https://promisesaplus.com/#point-75	https://promisesaplus.com/#point-64
https://promisesaplus.com/#point-61	https://promisesaplus.com/#point-57
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	https://bugs.jquery.com/ticket/13393
https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click	https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	https://connect.microsoft.com/IE/feedback/details/1736512/
https://jsperf.com/getall-vs-sizzle/2	https://drafts.csswg.org/cssom/#resolved-values
https://developer.mozilla.org/en-US/docs/CSS/display	https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
https://html.spec.whatwg.org/multipage/syntax.html#attributes-2	https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace	https://html.spec.whatwg.org/#strip-and-collapse-whitespace
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order
https://bugs.chromium.org/p/chromium/issues/detail?id=449857	http://example.com:80x/
https://bugs.webkit.org/show_bug.cgi?id=137337	https://bugs.webkit.org/show_bug.cgi?id=29084
https://bugs.chromium.org/p/chromium/issues/detail?id=589347	https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
https://github.com/jquery/jquery/pull/557	http://meyerweb.com/eric/tools/css/reset/
http://github.com/jrburke/requirejs	http://requirejs.org/docs/errors.html#
http://www.w3.org/1999/xhtml	http://github.com/requirejs/text
http://www.unicode.org/faq/utf_bom.html	http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4508058
https://getbootstrap.com/	https://github.com/twbs/bootstrap/blob/master/LICENSE
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	https://github.com/twbs/bootstrap/issues/10106
https://getbootstrap.com/docs/3.4/getting-started/#third-box-sizing	https://a11yproject.com/posts/how-to-hide-content
https://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1	https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile
https://github.com/twbs/bootstrap/pull/11526	https://github.com/twbs/bootstrap/issues/4885
https://github.com/twbs/bootstrap/issues/5257	https://github.com/twbs/bootstrap/issues/11660

Page 1 of 10

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhyjiE8xt4luuEXCOpE6FOHeq8pNeu1RwEsNq5KT4ehAz295dWgyFXNVsNxfTPW2QI50NiWnii0Vmg6xpCnngOF4Q5tHx14ujBm08UITVlqh0+7CTdEs/meh/DLlZWFW8L5KmA67mrHbVrBcZICik0njVrbgCfzMiC+z/KG78/JddHIzdTOAnc3H10YSKwF6aChnFi6w6th6nY+SwK29Bntw/OEC5ZO/zT6vmZ6Z1L1BWubkz+WA/skU9diijXHIbNCQqXMBbo4Bxn4vmXBPVnUvYDI1pjnxzavdZ2SeC4Cwwll2Ly9N8Zb5RdGMpe2BM6J+HuMzvAK2bvqekDIb4nwIDAQAB",
  "name": "Smartling Context Capture",
  "icons": {
    "16": "icons/hi16.png",
    "48": "icons/hi48.png",
    "128": "icons/hi128.png"
  },
  "action": {},
  "apiHost": "https://api.smartling.com",
  "ssoHost": "https://sso.smartling.com",
  "version": "5.1.2",
  "background": {
    "service_worker": "background/serviceWorker.js"
  },
  "short_name": "Context Capture",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Provide visual context for translators using the Smartling platform.",
  "permissions": [
    "identity",
    "activeTab",
    "tabs",
    "pageCapture",
    "storage",
    "contextMenus",
    "scripting",
    "userScripts"
  ],
  "options_page": "options/options.html",
  "dashboardHost": "https://dashboard.smartling.com",
  "content_scripts": [
    {
      "js": [
        "contentscripts/hotkeys.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';",
    "extension_pages": "script-src 'self'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "contentscripts/hotkey.js",
        "app/chromePlugin.html",
        "app/index.html",
        "app/partials/mainUI.html",
        "app/partials/login.tpl",
        "app/partials/wrapper.tpl",
        "app/partials/mainUI.tpl",
        "app/partials/tip.tpl",
        "lib/angular/angular.js",
        "app/js/require.js",
        "app/js/text.js",
        "app/js/main.js",
        "app/lib/tipsy/tipsy.js",
        "app/js/routes.js",
        "app/js/services.js",
        "app/js/controllers/ctrlLogin.js",
        "app/js/controllers/ctrlMainUI.js",
        "app/js/myApp.js",
        "app/js/factories/factories.js",
        "app/lib/select2/select2.min.js",
        "appendtopage/DOMselection/main.js",
        "appendtopage/DOMselection/selection.js",
        "loader.js",
        "contentscripts/jquery.js",
        "contentscripts/utils.js",
        "contentscripts/iframeManager.js",
        "contentscripts/snapshot.js",
        "contentscripts/extensionController.js",
        "contentscripts/main.js",
        "contentscripts/test.js",
        "/contentscripts/test.js",
        "contentscripts/jquery-1.10.2.min.map",
        "app/lib/angular/angular.min.js.map",
        "app/lib/angular/angular-cookies.min.js.map",
        "app/lib/angular/angular-resource.min.js.map",
        "app/lib/angular/angular-route.min.js.map",
        "app/lib/angular/angular-sanitize.min.js.map",
        "app/lib/jquery/dist/jquery.min.map",
        "app/css/app.css",
        "app/lib/select2/select2.css",
        "appendtopage/DOMselection/styles.css",
        "app/lib/select2/select2.png",
        "app/lib/select2/select2x2.png",
        "app/img/smartling-logo.png",
        "app/img/gear-2-xl.png"
      ]
    }
  ]
}

by ✦ Astarte

Smartling Context Capture

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (796 total):

Raw Manifest

Detections

Manifest Findings