[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

OneLogin for Google Chrome

Version 4.2.0 View in Chrome Web Store

Last scanned: about 14 hours ago

Extension Details

Developer: One Identity LLC

Rating: 3.0 ★ (101 ratings)

Users: 800,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 8 total findings, including 6 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
cookies
scripting
activeTab
declarativeNetRequest
declarativeNetRequestWithHostAccess
webRequest
tabs
webNavigation

Host Permissions:

http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self';

Embedded URLs (1195 total):

https://mths.be/punycode	https://app.onelogin.com/login
https://onelogininc.onelogin-shadow01.com	https://app.onelogin.com/images/logo_default@2x.png
https://onelogin.com	https://api.airbrake.io
https://notifier-configs.airbrake.io	https://github.com/airbrake/airbrake-js/tree/master/packages/browser
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
https://www.onelogin.com/	http://getsatisfaction.com/login
http://premier.dell.com/portal/start.aspx	https://app.streamsend.com/login
https://server1.streamsend.com/streamsend/	https://www.three.com.hk/appCS2/verifyLogin.do?action=login&lang=eng&URLTo=http%3A%2F%2Fwww.three.com.hk%2Fwebsite%2Fappmanager%2Fthree%2Fhome%3F_nfpb%3Dtrue%26pageid%3D000001%26_pageLabel%3DP200170391219567376547%26lang%3Deng
https://app.onelogin.com/openid/blockmastersecurity.com/	http://mobilecp.conduit.com/app/dashboard
https://www.rondee.com/app/RondeeMain/RondeeMain.html	http://funds.gofundme.com/index.php?route=fundmanager
http://internal.jgoptical.com:8888	http://www.secockpit.com/app/
http://social.itv.com/ver1.0/CMW/Overview	https://sso.itv.com/Register/SignIn.html
http://www.bestweekever.tv/	http://community.vh1.com/
http://community.tr3s.com/	https://portal.adp.com/wps/employee/employee.jsp
http://auth.cmt.com/	http://www.biccamera.com/#
https://www.biccamera.com/bicbic/app/w?SCREEN_ID=bw010000&fnc=f&ActionType=bw010000_12	http://www.thebeautyofnight.com
https://cologix.onelogin.com/launch/329336	https://glogin.rms.rakuten.co.jp/?sp_id=1
https://glogin.rms.rakuten.co.jp	https://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/aes.js
https://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/core-min.js	https://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/enc-base64-min.js
https://beck-online.beck.de/default.aspx?sec=	http://www.webtoolkit.info/
https://i-central.inntel.co.uk/SSOProcess.asp?	https://accounts.google.com/o/oauth2/auth?response_type=id_token&scope=email%20profile&prompt=select_account&client_id=466680526474.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fapp.hubspot.com%2Flogin%2FgoogleLoginRedirect&state=%7B%22client%22%3A%22HUBSPOT%22%7D
https://crashplanpro.com/login	https://start.exactonline.nl/docs/Login.aspx?ReturnUrl=%2fdocs%2fMenuPortal.aspx
https://app.asana.com/-/login	https://onelogin.slack.com/archives/D8H9JNWQ2/p1578694050005900
https://www.ovh.com/auth/?action=disconnect&onsuccess=https%3A%2F%2Fwww.ovh.com%2Fmanager%2F%23%2F	https://www.notion.so/login
https://onelogininc.onelogin.com/admin/connectors/139333/edit	https://app.easycontactnow.com/campaign/login.php
https://onelogininc.onelogin.com/admin/connectors/138290/edit	https://www-k6.thinkcentral.com/ePC/start.do
https://www.brainpop.com/	https://accounts.google.com/signin/v2/identifier?Email=
https://account.thehartford.com/customer/#/login?appid=OBSC&goto=https:%2F%2Fbusiness.thehartford.com%2Fhome.html%3Fcmp%3DEMC-SCSC-S0010	https://cfsb.sharefile.com/Authentication/Login
https://soundcloud.com/discover	https://onelogininc.onelogin.com/admin/connectors/145586/edit/
https://www.edcite.com/usr/signin	https://ca-live.adyen.com/ca/ca/login.shtml
https://onelogininc.onelogin.com/admin/connectors/134148/edit	https://afasonline.nl
https://idp.afasonline.com/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3D55f6be51-7326-4e9b-a652-bebd944d5b81%26response_type%3Dcode%26scope%3Dopenid%2520email%2520offline_access%26redirect_uri%3Dhttps%253A%252F%252Fsts.afasonline.com%252Fsignin-oidc%26state%3DQ2ZESjhCN295b29GQXJOTXJpTzc0Z1h2TG1ZbGtQbUxMakRrZVgtZkF4Rmw2U3JQaW00ZXVVMmNHTXJrQ1BHT19EWWNPSWVlbUpnWVJvZjc3akVIc2t2VFF4SGpTS1c5MF9NMFlYa215ZUtTSWl4M2dfbnB4MEpVRnVKbE44Z0x1X1VSWWJoR29lZHAycko5aDhtR0hrWkk5ZmVHa3dFWkZaM0hFUENIWnpDTk02QU5TVHVwbloxeEFuc1c0ZkE2UlpSY1lZVm5jczB0MDdFOWN5WFVQRXBBSnNwanJ4dUY5X0lUa0ZPdUtqVjB5MkIxdl9yb2dkSzNGN3JJTjI5SnFoa2NFbmpsR04wbm5OUTZjNF9hM0RVQ2NlRDdwSjU1bTJDck5VY0U1Z0F5VlEzQw%253D%253D%26nonce%3Dbd0b953215601a5cd3e651d68a348dc19e0bd9faa2c055d0896facf4ee4140a9%26response_mode%3Dquery%26ui_locales%3Den	https://app.cloudcraft.co/login
https://onelogininc.onelogin.com/admin/connectors/140135/edit	https://search.follettsoftware.com/metasearch/ui/50814
https://search.follettsoftware.com/metasearch/ui/50815	https://wtc2.webtitancloud.com:8443/login.php
https://www.onlinecomponents.com/	https://platform.mangahigh.com/en/login/student
https://login.edmentum.com/	https://onelogininc.onelogin.com/admin/connectors/138190/edit
https://reading.amplify.com/pub/pages/play.html	https://my.amplify.com/auth/realms/Amplify/protocol/openid-connect/auth?client_id=aqua-app&redirect_uri=https%3A%2F%2Freading.amplify.com%2Fpub%2Fpages%2Fplay.html&state=fae03a3e-9f19-425c-832a-94ab686cbf2b&response_mode=fragment&response_type=code&scope=openid&nonce=a22c48e6-269e-4aa8-876b-9ecb6d96f605
https://www.matific.com/us/en-us/login-page/	https://onelogininc.onelogin.com/admin/connectors/138193/edit

Page 1 of 15

Raw Manifest

{
  "name": "OneLogin for Google Chrome",
  "icons": {
    "16": "icons/normal/Icon-16.png",
    "48": "icons/normal/Icon-48.png",
    "128": "icons/normal/Icon-128.png"
  },
  "action": {
    "default_popup": "index.html"
  },
  "version": "4.2.0",
  "incognito": "split",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Single Sign-On for cloud lovers.",
  "permissions": [
    "storage",
    "cookies",
    "scripting",
    "activeTab",
    "declarativeNetRequest",
    "declarativeNetRequestWithHostAccess",
    "webRequest",
    "tabs",
    "webNavigation"
  ],
  "content_scripts": [
    {
      "js": [
        "contentPortal.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "include_globs": [
        "http://localhost:*/*",
        "http://*.onelogin*/*",
        "https://*.onelogin*/*"
      ]
    },
    {
      "js": [
        "contentAll.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    },
    {
      "js": [
        "injectedMethodUS.js",
        "injectedMethodEU.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
  }
}

by ✦ Astarte

OneLogin for Google Chrome

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (1195 total):

Raw Manifest

Detections

Manifest Findings