[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

prepview

Version 1.14 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Rating: 5.0 ★ (1 rating)

Users: 7

Context-Aware Verdict

HIGH

Overall Risk

Based on 6 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://accounts.google.com/*, https://www.googleapis.com/*, https://oauth2.googleapis.com/*, https://vision.googleapis.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
activeTab
scripting
storage

Host Permissions:

https://accounts.google.com/*
https://www.googleapis.com/*
https://oauth2.googleapis.com/*
https://vision.googleapis.com/*
chrome-extension://*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'

Embedded URLs (97 total):

http://www.apache.org/licenses/LICENSE-2.0	http://www.w3.org/2000/svg
http://www.xfa.org/schema/xci/	http://www.xfa.org/schema/xfa-connection-set/
http://www.xfa.org/schema/xfa-data/	http://www.xfa.org/schema/xfa-form/
http://www.xfa.org/schema/xfa-locale-set/	http://ns.adobe.com/xdp/pdf/
http://www.w3.org/2000/09/xmldsig#	http://www.xfa.org/schema/xfa-source-set/
http://www.w3.org/1999/XSL/Transform	http://www.xfa.org/schema/xfa-template/
http://www.xfa.org/schema/xdc/	http://ns.adobe.com/xdp/
http://ns.adobe.com/xfdf/	http://www.w3.org/1999/xhtml
http://ns.adobe.com/xmpmeta/	http://www.xfa.org/schema/xfa-data/1.0/
https://clients2.google.com/service/update2/crx	https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile	https://accounts.google.com/
https://www.googleapis.com/	https://oauth2.googleapis.com/
https://vision.googleapis.com/	http://www.w3.org/1998/Math/MathML
https://github.com/syntax-tree/hast-util-to-jsx-runtime	https://github.com/remarkjs/react-markdown/blob/main/changelog.md
https://api.openai.com/v1/chat/completions	https://feross.org/opensource
https://feross.org	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/	http://mths.be/fromcodepoint
http://schemas.microsoft.com/office/drawing/2014/chartex	http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
http://schemas.microsoft.com/office/drawing/2015/10/21/chartex	http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
http://schemas.microsoft.com/office/drawing/2016/5/10/chartex	http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
http://schemas.microsoft.com/office/drawing/2016/5/12/chartex	http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
http://schemas.microsoft.com/office/drawing/2016/5/14/chartex	http://schemas.openxmlformats.org/markup-compatibility/2006
http://schemas.microsoft.com/office/drawing/2016/ink	http://schemas.microsoft.com/office/drawing/2017/model3d
http://schemas.openxmlformats.org/officeDocument/2006/relationships	http://schemas.openxmlformats.org/officeDocument/2006/math
http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing	http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
http://schemas.openxmlformats.org/wordprocessingml/2006/main	http://schemas.microsoft.com/office/word/2010/wordml
http://schemas.microsoft.com/office/word/2012/wordml	http://schemas.microsoft.com/office/word/2018/wordml/cex
http://schemas.microsoft.com/office/word/2016/wordml/cid	http://schemas.microsoft.com/office/word/2018/wordml
http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahash	http://schemas.microsoft.com/office/word/2015/wordml/symex
http://schemas.microsoft.com/office/word/2010/wordprocessingGroup	http://schemas.microsoft.com/office/word/2010/wordprocessingInk
http://schemas.microsoft.com/office/word/2006/wordml	http://schemas.microsoft.com/office/word/2010/wordprocessingShape
https://answers.microsoft.com/en-us/msoffice/forum/all/does-word-support-more-than-9-list-levels/d130fdcd-1781-446d-8c84-c6c79124e4d7	http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
http://schemas.openxmlformats.org/package/2006/relationships	http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink
http://schemas.openxmlformats.org/officeDocument/2006/extended-properties	http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes
http://schemas.openxmlformats.org/package/2006/content-types	http://schemas.openxmlformats.org/package/2006/metadata/core-properties
http://purl.org/dc/elements/1.1/	http://purl.org/dc/terms/
http://purl.org/dc/dcmitype/	http://www.w3.org/2001/XMLSchema-instance
http://schemas.openxmlformats.org/officeDocument/2006/custom-properties	http://schemas.openxmlformats.org/officeDocument/2006/relationships/font
http://schemas.microsoft.com/office/word	http://schemas.openxmlformats.org/officeDocument/2006/relationships/header
http://schemas.openxmlformats.org/officeDocument/2006/relationships/footer	http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument

Page 1 of 2

Raw Manifest

{
  "name": "prepview",
  "icons": {
    "16": "app_icons/16x16.png",
    "128": "app_icons/128x128.png"
  },
  "action": {
    "default_icon": "app_icons/48x48.png",
    "default_popup": "index.html"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/userinfo.email",
      "https://www.googleapis.com/auth/userinfo.profile",
      "openid"
    ],
    "client_id": "319389431924-cam23n4olk9aa2s8g2favgrrjsho57d9.apps.googleusercontent.com"
  },
  "version": "1.14",
  "background": {
    "type": "module",
    "service_worker": "service-worker-loader.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Practice Interviews As You Browse.",
  "permissions": [
    "tabs",
    "activeTab",
    "scripting",
    "storage"
  ],
  "host_permissions": [
    "https://accounts.google.com/*",
    "https://www.googleapis.com/*",
    "https://oauth2.googleapis.com/*",
    "https://vision.googleapis.com/*",
    "chrome-extension://*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "pdfjs/*"
      ],
      "use_dynamic_url": false
    }
  ]
}

by ✦ Astarte

prepview

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (97 total):

Raw Manifest

Detections

Manifest Findings