[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

High Resolution Downloader for Instagram

Version 2.0.30 View in Chrome Web Store

Last scanned: 2 days ago | force re-scan

Extension Details

Rating: 3.9 ★ (143 ratings)

Users: 10,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a moderate user base of 10,000 downloads and a decent rating of 3.9/5 from 143 reviews, suggesting reasonable user satisfaction. However, the lack of visible developer information and company details reduces transparency and accountability.

Concerns:

- The clipboardWrite permission is concerning for an Instagram downloader, as this functionality isn't typically necessary for downloading images. This permission could potentially be misused to inject malicious content into your clipboard without your knowledge.

- Using the older Manifest V2 framework means fewer built-in security protections compared to the newer V3 standard.

- Content script access to Instagram could potentially intercept or modify your browsing data on the platform.

- Missing developer information makes it difficult to verify the extension's legitimacy or contact support if issues arise.

Recommendations:

Consider running this extension in a separate Chrome profile to isolate potential risks from your main browsing session. Monitor your clipboard contents after using the extension to ensure no unexpected data has been copied. Look for alternative Instagram downloaders that use Manifest V3 and have more transparent developer information. If you continue using this extension, regularly review what content gets copied to your clipboard and avoid pasting sensitive information immediately after using the extension.

Findings

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

clipboardWrite

Embedded URLs (131 total):

https://clients2.google.com/service/update2/crx	https://bugs.chromium.org/p/v8/issues/detail?id=4118
https://bugs.chromium.org/p/v8/issues/detail?id=3056	http://fb.me/prop-types-in-prod
https://www.instagram.com/p	https://github.com/mozilla/sweet.js/wiki/design
http://wiki.ecmascript.org/doku.php?id=harmony:const	http://wiki.ecmascript.org/doku.php?id=harmony:let
http://wiki.commonjs.org/wiki/Unit_Testing/1.0	http://narwhaljs.org
http://en.wikipedia.org/wiki/ANSI_escape_code#graphics	http://msdn.microsoft.com/en-us/library/ie/dww52sbt
http://fb.me/use-check-prop-types	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
https://fb.me/react-warning-dont-call-proptypes	https://github.com/facebook/react/issues/13610
https://github.com/facebookincubator/create-react-app/issues/3482	https://github.com/facebook/react/issues/13688
https://fb.me/react-crossorigin-error	https://github.com/facebook/react/issues/1698
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://url.spec.whatwg.org/#url-parsing	https://infra.spec.whatwg.org/#ascii-tab-or-newline
https://infra.spec.whatwg.org/#c0-control-or-space	https://github.com/facebook/react/issues/11768
http://www.w3.org/TR/2012/WD-html5-20121025/the-input-element.html	https://fb.me/react-controlled-components
https://bugs.chromium.org/p/chromium/issues/detail?id=608416	https://github.com/facebook/react/issues/7253
https://developer.microsoft.com/microsoft-edge/platform/issues/101525/	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	http://www.w3.org/2000/svg
https://github.com/facebook/react/issues/12506	http://www.quirksmode.org/js/events_properties.html
http://www.quirksmode.org/blog/archives/2010/09/click_event_del.html	https://github.com/mozilla/gecko-dev/blob/4e638efc71/layout/style/test/property_database.js
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet	http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/
http://modernizr.com/docs/#prefixed	http://www.andismith.com/blog/2012/02/modernizr-prefixed/
https://fb.me/react-invariant-dangerously-set-inner-html	https://w3c.github.io/webcomponents/spec/custom/#custom-elements-core-concepts
https://fb.me/invalid-aria-prop	https://fb.me/react-attribute-behavior
https://electronjs.org/docs/api/webview-tag	https://github.com/facebook/react/issues/11807
https://www.w3.org/TR/html5/single-page.html#preprocessing-the-input-stream	https://github.com/facebook/react/pull/11157.
https://github.com/facebook/react/issues/6731#issuecomment-254874553	https://github.com/facebook/react/pull/6896
https://bugzilla.mozilla.org/show_bug.cgi?id=1276240	https://github.com/facebook/react/issues/13222
https://github.com/facebook/react/issues/14239	https://github.com/facebook/react/pull/10676.
https://bugzilla.mozilla.org/show_bug.cgi?id=208427	https://html.spec.whatwg.org/multipage/browsers.html#integration-with-idl
https://html.spec.whatwg.org/#do-not-apply	https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-scope
https://html.spec.whatwg.org/multipage/syntax.html#special	https://html.spec.whatwg.org/multipage/syntax.html#html-integration-point
https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-button-scope	https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody	https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inselect
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intd	https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incaption
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intr	https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intbody
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incolgroup	https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intable
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead	https://html.spec.whatwg.org/multipage/semantics.html#the-html-element
https://github.com/facebook/react/issues/11918	http://www.w3.org/TR/DOM-Level-3-Events/
https://fb.me/react-event-pooling	http://www.w3.org/TR/DOM-Level-3-Events/#events-compositionevents
http://www.w3.org/TR/2013/WD-DOM-Level-3-Events-20131105	https://code.google.com/p/chromium/issues/detail?id=355103

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "icon_16.png",
    "48": "icon_48.png",
    "128": "icon_128.png"
  },
  "version": "2.0.30",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "clipboardWrite"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "*://*.instagram.com/*"
      ]
    }
  ],
  "manifest_version": 2
}

by ✦ Astarte