[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

Functionize Architect

Version 10.7.89 View in Chrome Web Store

Last scanned: over 1 year ago | force re-scan

Extension Details

Developer: functionize.com

Rating: 4.8 ★ (21 ratings)

Size: 1.42MiB

Last Updated: April 1, 2025

Users: 100,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

- The extension has over 100,000 users, indicating some level of popularity and trust.

- It is developed by a company (functionize.com) rather than an individual, which can provide more accountability.

- The relatively high rating of 4.8/5 from 21 reviews suggests most users find it useful and trustworthy.

Concerns:

- The extension requests an extremely broad set of permissions, including the ability to read clipboard data, control proxy settings, access all browser tabs and web requests, modify cookies, track web navigation, download files, debug other extensions, and inject scripts into any website.

- Many of these permissions pose significant privacy and security risks if misused, such as stealing sensitive data or credentials, modifying website content, or enabling remote code execution.

- The extension's content security policy allows unsafe WebAssembly execution, which could be leveraged for malicious purposes.

Recommendations:

- Exercise extreme caution when installing this extension, as it has sweeping capabilities that could compromise your privacy and security if it is not fully trustworthy.

- Consider running the extension in a separate browser profile or testing environment to isolate it from your main browsing activity.

- Closely monitor the extension's behavior and network activity for any suspicious actions.

- Periodically review the extension's permissions and revoke any unnecessary ones to reduce its potential attack surface.

- Ensure you have installed the extension from a reputable source, as malicious versions could be injected into unofficial distribution channels.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: debugger

This extension has the debugger permission. Can debug and manipulate other extensions/apps. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: proxy

This extension has the proxy permission. Can control proxy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

alarms
clipboardRead
storage
proxy
tabs
webRequest
cookies
unlimitedStorage
activeTab
webNavigation
browsingData
downloads
debugger
scripting

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
sandbox: sandbox allow-scripts; script-src 'self'

Embedded URLs (145 total):

https://vuejs.org/error-reference/#runtime-	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xlink
https://vuejs.org/error-reference/#compiler-	https://next.vuex.vuejs.org/
https://vuejs.org/images/icons/favicon-96x96.png	https://www.functionizeapp.com
https://alpservice.functionize.com:5000/predict	https://www.functionizeapp.com/tools/emailreader
https://www.functionizeapp.com/tools/textreader	https://us-central1-wise-arch-107501.cloudfunctions.net/architect-allowed-domains
https://github.com/facebook/regenerator/blob/main/LICENSE	https://www1.functionize.com/proxy/index/getproxy
https://github.com/facebook/regenerator/issues/274	https://html.spec.whatwg.org/multipage/parsing.html#tree-construction-dispatcher
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume	https://www.functionizeapp.com/tools/apiexplorer
https://www.functionizeapp.com/tools/fileviewer	https://www.functionizeapp.com/tools/dbexplorer
http://app.functionize.com/	https://app.functionize.com/
http://www.w3.org/1999/xhtml	http://pupunzi.com
http://pupunzi.open-lab.com	http://open-lab.com
http://www.opensource.org/licenses/mit-license.php	http://www.gnu.org/licenses/gpl.html
http://eligrey.com	https://github.com/eligrey/classList.js/blob/master/LICENSE.md
http://purl.eligrey.com/github/classList.js/blob/master/classList.js	https://github.com/andris9/simpleStorage
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/assign	https://github.com/santiycr
https://github.com/santiycr/cssify	https://github.com/Dither
https://github.com/svenheden	https://github.com/facebook/flow/issues/1414
https://github.com/popperjs/popper-core/issues/1223	https://github.com/eligrey/classList.js/issues/36
http://www.w3.org/TR/html401/interact/forms.html#h-17.13.2	https://developer.mozilla.org/en-US/docs/Web/API/Element/children
https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block	https://github.com/atomiks/tippy.js-react/issues/106
https://github.com/atomiks/tippyjs-react/issues/177	https://github.com/limonte/sweetalert2/blob/99bd539f85e15ac170f69d35001d12e092ef0054/src/utils/dom.js#L194
https://github.com/popperjs/popper-core/issues/1078	https://github.com/popperjs/popper-core/issues/837
https://stackoverflow.com/questions/49875255	https://clients2.google.com/service/update2/crx
https://www.functionize.com	http://polymer.github.io/LICENSE.txt
http://polymer.github.io/AUTHORS.txt	http://polymer.github.io/CONTRIBUTORS.txt
http://polymer.github.io/PATENTS.txt	http://worldtimeapi.org/api/timezone/America/Detroit
https://curl.service.functionize.com/api/v1/execute-curl	https://tailwindcss.com
https://github.com/mozdevs/cssremedy/issues/4	https://github.com/tailwindcss/tailwindcss/pull/116
https://bugzilla.mozilla.org/show_bug.cgi?id=190655	https://bugs.chromium.org/p/chromium/issues/detail?id=999088
https://bugs.webkit.org/show_bug.cgi?id=201297	https://bugs.chromium.org/p/chromium/issues/detail?id=935729
https://bugs.webkit.org/show_bug.cgi?id=195016	https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/forms.css#L728-L737
https://github.com/tailwindlabs/tailwindcss/issues/3300	https://github.com/mozdevs/cssremedy/issues/14
https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210	https://fonts.googleapis.com/css?family=Rubik:400
https://daneden.github.io/animate.css	http://www.w3.org/2000/svg%27%3E%3Cg
http://www.w3.org/2000/svg%27%3E%3Ccircle	https://modal.jenesius.com/docs.html/installation#getting-started.
https://modal.jenesius.com/docs.html/integration-vue-router#installation	https://alpdemo.functionize.com/api/spellcheck
https://alpdemo.functionize.com/api/advance_feature_name	https://alpdemo.functionize.com/api/predict_advance_feature_name
https://support.functionize.com/hc/en-us/articles/360047907333	https://default-eservice-dot-wise-arch-107501.appspot.com/extensions/

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtbZIEHJ0Im6MfIFiwj/NVleCe/UNX/H5F6bDfwl+6Ktg3JiIGq7o9xRpO1GG7Ab+RrLliyPHKoOmYR+GY9fgBEdioDPUZoXLX8NJymS2Bw/D4bZBKBH9YN+gdGvkulG+C8X71Gv0JnR0K8pTMkkt1qExf1L2l0RRAKpyXBNV3NqjlixHo+tmR5/Zv0O5tS9ej5EweVtfeRp7+X3BbP2hiGyXGP0YoNVmQBjJMlXvAfHObJrn4AhsoQhUzWlNGHRwQ8jVhBBYCzN431tXaFdaJf3ne0yy0LVuhVSz27v597KkmwJigQ6XJeH4V4Z9ySPflLsqTniKS82Wh+av9L5QpQIDAQAB",
  "name": "Functionize Architect",
  "icons": {
    "48": "icons/32x32.png",
    "128": "icons/64x64.png"
  },
  "action": {
    "default_icon": {
      "19": "icons/32x32.png",
      "48": "icons/64x64.png"
    },
    "default_title": "Functionize Architect"
  },
  "author": "dev@ Functionize Inc, https://www.functionize.com",
  "version": "10.7.89",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "options/options.html"
  },
  "short_name": "Architect",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Functionize extension for Architect",
  "permissions": [
    "alarms",
    "clipboardRead",
    "storage",
    "proxy",
    "tabs",
    "webRequest",
    "cookies",
    "unlimitedStorage",
    "activeTab",
    "webNavigation",
    "browsingData",
    "downloads",
    "debugger",
    "scripting"
  ],
  "version_name": "10.7.89",
  "content_scripts": [
    {
      "js": [
        "content-scripts/empty.js"
      ],
      "matches": [
        "*://app.functionize.com/*"
      ]
    },
    {
      "js": [
        "content-scripts/webcomponents-bundle.js"
      ],
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "*://*.functionize.com/",
      "*://*.functionize.com/*"
    ]
  },
  "minimum_chrome_version": "92",
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'self'",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "content-scripts/ajaxOverridesScript.js",
        "content-scripts/overridesScript.js",
        "content-scripts/insertScript.js",
        "images/*",
        "fonts/*",
        "popup/popup.html",
        "functionise.js.map:"
      ],
      "extension_ids": []
    }
  ]
}

by ✦ Astarte

Functionize Architect

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (145 total):

Raw Manifest

Detections

Manifest Findings