[ new scan ] [ statistics ] [ github ] [ twitter ]

Starting analysis...

Whatfix for Compass

Version 2025.6.10.1354 View in Chrome Web Store

Last scanned: 12 days ago | force re-scan

Extension Details

Rating: 4.6 ★

Size: 34.89MiB

Last Updated: June 10, 2025

Users: 6,000

Developer Info: Whatfix Private Limited1090e, 18th Cross Road Bengaluru, Karnataka 560102 IN

Context-Aware Verdict

MEDIUM

Risk Level

Trust Factors:

- The extension is developed by a legitimate company, Whatfix Private Limited, which specializes in digital adoption solutions.

- It has a relatively high rating of 4.6 stars from 6,000 users, indicating a positive reception.

- The extension is likely intended for internal use within Compass Group, a large food service company, which may explain the broad host permissions.

Concerns:

- The webNavigation permission allows the extension to track web navigation, which could potentially compromise user privacy and security if misused.

- The broad host permissions grant access to various Compass Group domains, which could enable data exfiltration or browsing activity tracking if the extension is compromised.

Recommendations:

- If you are a Compass Group employee and need to use this extension for work purposes, consider running it in a separate Chrome profile dedicated to work-related activities.

- Monitor the extension's behavior and ensure it is not accessing or transmitting sensitive data without your knowledge or consent.

- Keep the extension updated to the latest version to benefit from security patches and bug fixes.

- If you are not a Compass Group employee or do not require this extension, it is recommended to remove it from your browser to minimize potential risks.

Security Analysis

HIGH

Overall Risk

Based on 3 total findings, ranked without considering overall context, including 2 high-risk and 1 medium-risk findings.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

webNavigation
storage
alarms

Host Permissions:

https://*.whatfix.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (139 total):

https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE	https://github.com/csstree/csstree?tab=readme-ov-file#features
http://opensource.org/licenses/BSD-3-Clause	https://code.google.com/p/closure-compiler/source/browse/trunk/src/com/google/debugging/sourcemap/Base64VLQ.java
https://github.com/Polymer/polymer-bundler/pull/519	https://github.com/mozilla/source-map/pull/31
https://github.com/mozilla/source-map/issues/30	https://www.w3.org/TR/css-values-4/#component-multipliers
https://drafts.csswg.org/css-values-3/#numeric-ranges	https://www.w3.org/TR/css-syntax-3/#serialization
https://github.com/w3c/csswg-drafts/pull/6874	https://www.w3.org/TR/css-syntax-3/#anb
https://drafts.csswg.org/css-cascade-5/	https://drafts.csswg.org/css-syntax/#urange
https://drafts.csswg.org/css-values/#calc-notation	https://drafts.csswg.org/css-values-4/#custom-idents
https://developer.mozilla.org/en-US/docs/Web/CSS/custom-ident	https://drafts.csswg.org/css-variables/#typedef-custom-property-name
https://drafts.csswg.org/css-color-4/#hex-notation	https://drafts.csswg.org/css-syntax/#any-value
https://drafts.csswg.org/css-values-4/#percentages	https://drafts.csswg.org/css-values-4/#numbers
https://drafts.csswg.org/css-values-4/#integers	https://github.com/csstree/csstree/issues
https://drafts.csswg.org/css-values-4/#lengths	https://www.w3.org/TR/css-values-3/#lengths
https://drafts.csswg.org/css-values-4/#font-relative-lengths	https://drafts.csswg.org/css-values-4/#viewport-relative-lengths
https://drafts.csswg.org/css-contain-3/#container-lengths	https://www.w3.org/TR/css-values-3/#angles
https://www.w3.org/TR/css-values-3/#time	https://www.w3.org/TR/css-values-3/#frequency
https://www.w3.org/TR/css-values-3/#resolution	https://drafts.csswg.org/css-grid/#fr-unit
https://www.w3.org/TR/css3-speech/#mixing-props-voice-volume	https://www.w3.org/TR/css3-speech/#voice-props-voice-pitch
https://drafts.csswg.org/css-syntax/#declaration-diagram	https://drafts.csswg.org/mediaqueries-3/#values
https://drafts.csswg.org/css-syntax-3/	https://en.wikipedia.org/wiki/Byte_order_mark
https://drafts.csswg.org/css-syntax-3/#consume-token	https://www.w3.org/TR/css-syntax-3/
https://drafts.csswg.org/cssom/#serialize-an-identifier	https://drafts.csswg.org/cssom/#serialize-a-string
https://developer.chrome.com/docs/extensions/reference/alarms/	https://whatfix.atlassian.net/browse/SUCC-6316
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://whatfix.com/community/#	https://whatfix.com/terms-services/
https://whatfix.com/privacy-policy/	https://support.whatfix.com/docs/manageextensionsonthewhatfixdashboard
https://support.whatfix.com/docs/triggeringliveinstructionsthroughjavascript	https://support.whatfix.com/docs/multi-languagesupport
https://support.whatfix.com/docs/structureoflanguagepropertyfiles	https://support.whatfix.com/docs/identifyingconditionsforshowingtooltips
https://support.whatfix.com/docs/branchinginawalkthrough	https://support.whatfix.com/docs/whatfixreleasenotes
https://support.whatfix.com/docs/tasklistapi	https://support.whatfix.com/docs/usingvideoplayerparameters
https://support.whatfix.com/docs/selfhelpwidgetapi	https://support.whatfix.com/docs/selfhostingwhatfixcontent
https://support.whatfix.com/x/_gAF	https://support.whatfix.com/docs/usingdynamicurlsforyourflows
https://help.whatfix.com/pages/viewpage.action?pageId=328693	https://support.whatfix.com/docs/downloadexportedflowsfromwhatfixcloudusingwhatfixapi
https://support.whatfix.com/docs/generatingtheapitoken	https://support.whatfix.com/docs/backbuttonforwalkthroughhelptips
https://support.whatfix.com/docs/settingupgoogleanalyticsfromthewhatfixdashboard	https://support.whatfix.com/studio/docs/self-hosting-whatfix-content
https://clients2.google.com/service/update2/crx	https://saplqs4b3001.na.compassgroup.corp:8002/
https://s4uwss.compass-usa.com/	https://s4prod.compass-usa.com/
https://addons.whatfix.com/	http://code.google.com/p/google-web-toolkit/issues/detail?id=2079
http://www.w3	https://www.youtube.com/embed/
https://microsoftedge.microsoft.com/addons/detail/	https://chrome.google.com/webstore/detail/

Page 1 of 2

Raw Manifest

{
  "name": "Whatfix for Compass",
  "icons": {
    "16": "logo16.png",
    "19": "logo19.png",
    "32": "logo32.png",
    "38": "logo38.png",
    "48": "logo48.png",
    "128": "logo128.png"
  },
  "action": {
    "browser_action": {
      "default_icon": "logo19.png",
      "default_title": "Whatfix for Compass"
    }
  },
  "version": "2025.6.10.1354",
  "background": {
    "service_worker": "extension.background/extension.background.nocache.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Whatfix provides in-app interactive guides and walkthroughs to Ease User Onboarding, Reduce Training, and Improve Support.",
  "permissions": [
    "webNavigation",
    "storage",
    "alarms"
  ],
  "content_scripts": [
    {
      "js": [
        "extension.foreground/extension.foreground.nocache.js"
      ],
      "matches": [
        "https://saplqs4b3001.na.compassgroup.corp:8002/*",
        "https://s4uwss.compass-usa.com/*",
        "https://s4prod.compass-usa.com/*",
        "*://*.compassmanager.com/*",
        "*://*.compassmylms.com/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "https://*.whatfix.com/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://*.whatfix.com/*/extension/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://saplqs4b3001.na.compassgroup.corp:8002/*",
        "https://s4uwss.compass-usa.com/*",
        "https://s4prod.compass-usa.com/*",
        "*://*.compassmanager.com/*",
        "*://*.compassmylms.com/*"
      ],
      "resources": [
        "whatfix.com/*",
        "config.json",
        "env.json",
        "modules/*"
      ]
    }
  ]
}

Whatfix for Compass

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (139 total):

Raw Manifest

Secure Annex (beta)