[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

XSLT Polyfill

Version 1.0.24 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Rating: 4.6 ★ (9 ratings)

Users: 70,000

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 1 total findings, including 1 high-risk finding.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

Security Analysis Details

Embedded URLs (26 total):

https://clients2.google.com/service/update2/crx	http://www.jclark.com/xt
http://exslt.org/sets	http://exslt.org/functions
http://exslt.org/strings	http://exslt.org/dates-and-times
http://icl.com/saxon	http://exslt.org/common
http://www.w3.org/1999/XSL/Transform	http://www.w3.org/1999/xhtml
http://exslt.org/math	http://xmlsoft.org/XSLT/namespace
http://www.w3.org/XML/1998/namespace	http://www.w3.org/TR/html4/frameset.dtd
http://www.w3.org/TR/1999/REC-html401-19991224/frameset.dtd	http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd
http://www.w3.org/TR/html4/strict.dtd	http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd
http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd	http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
http://www.w3.org/TR/html4/loose.dtd	http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd
http://www.w3.org/TR/REC-html40/loose.dtd	http://exslt.org/dynamic
http://www.w3.org/2000/xmlns/	http://xmlsoft.org/XSLT/

Raw Manifest

{
  "name": "XSLT Polyfill",
  "version": "1.0.24",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Applies an XSLT polyfill to all XML documents.",
  "content_scripts": [
    {
      "js": [
        "content.js",
        "xslt-polyfill.min.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "manifest_version": 3
}

by ✦ Astarte