[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Hoverflow

Version 1.2.5 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: Moonstop Software Ltd

Rating: 4.7 ★ (33 ratings)

Users: 1,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a solid 4.7-star rating from 33 reviews and is developed by Moonstop Software Ltd, which suggests some level of legitimacy. However, the relatively low user count of 1,000 users indicates limited adoption, which could mean less community vetting. The lack of a clear description makes it difficult to assess the extension's intended purpose and whether its permissions are justified.

Concerns: The most significant concern is the broad host permissions for Wikipedia domains, which seems excessive unless the extension specifically enhances Wikipedia functionality. The combination of scripting, activeTab, and declarativeNetRequestWithHostAccess permissions creates a powerful toolkit that could potentially be misused. The storage permission, while common, adds to the overall permission footprint. The missing description is particularly concerning as users cannot properly evaluate whether the requested permissions align with the extension's stated functionality.

Recommendations: Given the medium risk level, consider running this extension in a separate Chrome profile to isolate potential security risks from your main browsing environment. Before installation, research the extension's actual purpose through user reviews or the developer's website to determine if the Wikipedia-focused permissions are appropriate. Monitor the extension's behavior after installation and remove it if you notice any unexpected activity. Consider looking for alternative extensions with clearer descriptions and more transparent permission usage if this extension's purpose remains unclear.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
scripting
activeTab
declarativeNetRequestWithHostAccess

Optional Permissions:

bookmarks

Host Permissions:

https://*.wikipedia.org/*

Embedded URLs (20 total):

https://clients2.google.com/service/update2/crx	http://127.0.0.1/
http://127.0.0.1:	https://hoverflow.io/
https://hoverflow.io/upgrade	https://web.dev/sandboxed-iframes
https://twitter.com/hoverflowio	https://www.twitch.tv
https://www.youtube.com	http://www.w3.org/2000/svg
https://fontawesome.com	https://fontawesome.com/license/free
https://fontawesome.com/license	https://forms.gle/QJgxoSU4VaN8m7Pr6
https://hoverflow.io/welcome	https://hoverflow.io/update
https://activate-mbo72rwysq-ew.a.run.app	https://verify-mbo72rwysq-ew.a.run.app
https://hoverflow.io	https://billing.stripe.com/p/login/7sIbLU5G1aPjbuw144

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "/icons/16.png",
    "32": "/icons/32.png",
    "48": "/icons/48.png",
    "128": "/icons/128.png"
  },
  "action": {
    "default_icon": {
      "16": "/icons/grey/16.png",
      "32": "/icons/grey/32.png",
      "48": "/icons/grey/48.png",
      "128": "/icons/grey/128.png"
    },
    "default_title": "__MSG_actionTitle__"
  },
  "version": "1.2.5",
  "background": {
    "service_worker": "src/serviceWorker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "storage",
    "scripting",
    "activeTab",
    "declarativeNetRequestWithHostAccess"
  ],
  "options_page": "settings.html",
  "default_locale": "en",
  "host_permissions": [
    "https://*.wikipedia.org/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "bookmarks"
  ],
  "externally_connectable": {
    "matches": [
      "https://hoverflow.io/*"
    ]
  },
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "frameRules",
        "path": "rules.json",
        "enabled": true
      }
    ]
  },
  "optional_host_permissions": [
    "https://*/*",
    "http://localhost/*",
    "http://localhost:*/*",
    "http://127.0.0.1/*",
    "http://127.0.0.1:*/*"
  ]
}

by ✦ Astarte

Hoverflow

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (20 total):

Raw Manifest

Detections

Manifest Findings