[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Whatfix for Compass

Version 2026.4.2.841 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Rating: 4.9 ★

Users: 723

Context-Aware Verdict

HIGH

Overall Risk

Based on 3 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

webNavigation
storage
alarms

Host Permissions:

https://*.whatfix.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (174 total):

https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE	https://whatfix.atlassian.net/browse/SUCC-6316
https://developer.chrome.com/docs/extensions/reference/alarms/	https://drafts.csswg.org/cssom/#serialize-an-identifier
https://www.w3.org/TR/css-syntax-3/#anb	http://opensource.org/licenses/BSD-3-Clause
https://code.google.com/p/closure-compiler/source/browse/trunk/src/com/google/debugging/sourcemap/Base64VLQ.java	https://drafts.csswg.org/css-cascade-5/
https://drafts.csswg.org/css-syntax/#urange	https://github.com/Polymer/polymer-bundler/pull/519
https://www.w3.org/TR/css-syntax-3/#serialization	https://github.com/w3c/csswg-drafts/pull/6874
https://github.com/csstree/csstree/issues	https://drafts.csswg.org/css-values-4/#custom-idents
https://drafts.csswg.org/css-values-4/#lengths	https://drafts.csswg.org/cssom/#serialize-a-string
https://drafts.csswg.org/css-syntax-3/#consume-token	https://www.w3.org/TR/css-values-4/#component-multipliers
https://drafts.csswg.org/css-values-3/#numeric-ranges	https://github.com/csstree/csstree?tab=readme-ov-file#features
https://drafts.csswg.org/css-syntax/#declaration-diagram	https://drafts.csswg.org/mediaqueries-3/#values
https://drafts.csswg.org/css-values/#calc-notation	https://developer.mozilla.org/en-US/docs/Web/CSS/custom-ident
https://drafts.csswg.org/css-variables/#typedef-custom-property-name	https://drafts.csswg.org/css-color-4/#hex-notation
https://drafts.csswg.org/css-syntax/#any-value	https://drafts.csswg.org/css-values-4/#percentages
https://drafts.csswg.org/css-values-4/#numbers	https://drafts.csswg.org/css-values-4/#integers
https://drafts.csswg.org/css-syntax-3/	https://en.wikipedia.org/wiki/Byte_order_mark
https://www.w3.org/TR/css-syntax-3/	https://github.com/mozilla/source-map/pull/31
https://github.com/mozilla/source-map/issues/30	https://www.w3.org/TR/css-values-3/#lengths
https://drafts.csswg.org/css-values-4/#font-relative-lengths	https://drafts.csswg.org/css-values-4/#viewport-relative-lengths
https://drafts.csswg.org/css-contain-3/#container-lengths	https://www.w3.org/TR/css-values-3/#angles
https://www.w3.org/TR/css-values-3/#time	https://www.w3.org/TR/css-values-3/#frequency
https://www.w3.org/TR/css-values-3/#resolution	https://drafts.csswg.org/css-grid/#fr-unit
https://www.w3.org/TR/css3-speech/#mixing-props-voice-volume	https://www.w3.org/TR/css3-speech/#voice-props-voice-pitch
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://whatfix.com/community/#	https://whatfix.com/terms-services/
https://whatfix.com/privacy-policy/	https://support.whatfix.com/docs/manageextensionsonthewhatfixdashboard
https://support.whatfix.com/docs/triggeringliveinstructionsthroughjavascript	https://support.whatfix.com/docs/multi-languagesupport
https://support.whatfix.com/docs/structureoflanguagepropertyfiles	https://support.whatfix.com/docs/identifyingconditionsforshowingtooltips
https://support.whatfix.com/docs/branchinginawalkthrough	https://support.whatfix.com/docs/whatfixreleasenotes
https://support.whatfix.com/docs/tasklistapi	https://support.whatfix.com/docs/usingvideoplayerparameters
https://support.whatfix.com/docs/selfhelpwidgetapi	https://support.whatfix.com/docs/selfhostingwhatfixcontent
https://support.whatfix.com/x/_gAF	https://support.whatfix.com/docs/usingdynamicurlsforyourflows
https://help.whatfix.com/pages/viewpage.action?pageId=328693	https://support.whatfix.com/docs/downloadexportedflowsfromwhatfixcloudusingwhatfixapi
https://support.whatfix.com/docs/generatingtheapitoken	https://support.whatfix.com/docs/backbuttonforwalkthroughhelptips
https://support.whatfix.com/docs/settingupgoogleanalyticsfromthewhatfixdashboard	https://support.whatfix.com/studio/docs/self-hosting-whatfix-content
https://clients2.google.com/service/update2/crx	https://saplqs4b3001.na.compassgroup.corp:8002/
https://s4uwss.compass-usa.com/	https://s4prod.compass-usa.com/
https://addons.whatfix.com/	https://cdn.whatfix.com/prod/a0312a20-0ffa-11ec-91b1-3e2a4292da47/content/1773868281621
http://code.google.com/p/google-web-toolkit/issues/detail?id=2079	https://microsoftedge.microsoft.com/addons/detail/
https://chrome.google.com/webstore/detail/	http://www.w3.org/1998/Math/MathML

Page 1 of 3

Raw Manifest

{
  "name": "Whatfix for Compass",
  "icons": {
    "16": "logo16.png",
    "19": "logo19.png",
    "32": "logo32.png",
    "38": "logo38.png",
    "48": "logo48.png",
    "128": "logo128.png"
  },
  "action": {
    "browser_action": {
      "default_icon": "logo19.png",
      "default_title": "Whatfix for Compass"
    }
  },
  "version": "2026.4.2.841",
  "incognito": "split",
  "background": {
    "service_worker": "extension.background/extension.background.nocache.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Whatfix provides in-app interactive guides and walkthroughs to Ease User Onboarding, Reduce Training, and Improve Support.",
  "permissions": [
    "webNavigation",
    "storage",
    "alarms"
  ],
  "content_scripts": [
    {
      "js": [
        "extension.foreground/extension.foreground.nocache.js"
      ],
      "matches": [
        "*://*.compassmanager.com/*",
        "https://saplqs4b3001.na.compassgroup.corp:8002/*",
        "https://s4uwss.compass-usa.com/*",
        "https://s4prod.compass-usa.com/*",
        "*://*.compassmylms.com/*"
      ],
      "all_frames": true,
      "exclude_matches": [
        "*://myfinance2.compassmanager.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://*.whatfix.com/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://*.whatfix.com/*/extension/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*.compassmanager.com/*",
        "https://saplqs4b3001.na.compassgroup.corp:8002/*",
        "https://s4uwss.compass-usa.com/*",
        "https://s4prod.compass-usa.com/*",
        "*://*.compassmylms.com/*"
      ],
      "resources": [
        "whatfix.com/*",
        "config.json",
        "env.json",
        "environment.json",
        "modules/*"
      ]
    }
  ]
}

by ✦ Astarte

Whatfix for Compass

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (174 total):

Raw Manifest

Detections

Manifest Findings