Bookmarks Backuper

Version 0.2.1.2 View in Chrome Web Store

Last scanned: 20 days ago | force re-scan

Extension Details

Developer: bookmarksbackuper.com

Rating: 3.9 ★ (45 ratings)

Users: 1,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a modest user base of 1,000 users with a decent 3.9-star rating from 45 reviews, suggesting some level of user satisfaction. The developer uses a domain-specific website (bookmarksbackuper.com) which indicates some investment in the project. The CSP policy is well-configured with strict security controls and only allows connections to legitimate services like Google APIs and Dropbox.

Concerns: The combination of identity and bookmarks permissions creates significant privacy risks. While bookmarks access is expected for a backup tool, the identity permission allows access to your Google account information, which goes beyond what's necessary for basic bookmark backup functionality. The extension could potentially access personal information and correlate it with your browsing patterns stored in bookmarks. The relatively small user base and lack of detailed developer information raise additional trust concerns.

Recommendations: Consider running this extension in a separate Chrome profile to isolate it from your main browsing data. Before installation, verify that the backup functionality truly requires Google account access - many bookmark backup tools can function without identity permissions by using local storage or manual export methods. Monitor the extension's network activity to ensure it only communicates with the declared services. Consider alternatives that require fewer permissions or have larger, more established user bases with transparent privacy policies.

Findings

HIGH

High-Risk Permission: bookmarks

This extension has the bookmarks permission. Can access and modify bookmarks. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

identity
bookmarks
storage

Content Security Policy:

extension_pages: require-trusted-types-for 'script'; trusted-types 'none'; child-src 'none'; connect-src https://accounts.google.com https://api.dropboxapi.com https://chromewebstore.google.com https://clouderrorreporting.googleapis.com https://docs.google.com https://sheets.googleapis.com https://www.dropbox.com https://www.googleapis.com; default-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'none'; script-src-elem 'nonce-bb_nonce'; script-src-attr 'none'; style-src 'none'; style-src-elem 'nonce-bb_nonce'; style-src-attr 'none'; worker-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'

Embedded URLs (49 total):

https://developer.chrome.com/docs/extensions/reference/api/bookmarks#property-BookmarkTreeNode-parentId	https://developer.chrome.com/docs/extensions/reference/api/bookmarks#property-BookmarkTreeNode-url
https://clouderrorreporting.googleapis.com/v1beta1/projects/%s/events:report	https://chromewebstore.google.com/detail/bookmarks-backuper/jdcbhaadjnkcdklbjkmgbpjaoonekpjd/reviews
https://docs.google.com/spreadsheets/d/%s/edit	https://sheets.googleapis.com/v4/spreadsheets/%s/values/A2:D:clear
https://sheets.googleapis.com/v4/spreadsheets/%s/values/A2:D	https://www.googleapis.com/drive/v3/files
https://sheets.googleapis.com/v4/spreadsheets	https://www.googleapis.com/drive/v3/files/%s
https://accounts.google.com/o/oauth2/revoke?token=%s	https://www.dropbox.com/oauth2/authorize
https://api.dropboxapi.com/oauth2/token	https://api.dropboxapi.com/2/auth/token/revoke
https://api.dropboxapi.com/2/file_properties/templates/list_for_user	https://api.dropboxapi.com/2/file_properties/templates/add_for_user
https://api.dropboxapi.com/2/file_properties/templates/get_for_user	https://api.dropboxapi.com/2/file_properties/properties/add
https://api.dropboxapi.com/2/file_properties/properties/search	https://api.dropboxapi.com/2/files/paper/create
https://api.dropboxapi.com/2/files/paper/update	https://api.dropboxapi.com/2/sharing/get_file_metadata
https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Objects/Object_prototypes#using_a_constructor	https://tc39.es/ecma262/#sec-time-values-and-time-range
https://2ality.com/2014/05/is-integer.html	https://tc39.es/ecma262/#integral-number
https://cloud.google.com/error-reporting/reference/rest/v1beta1/projects.events/report#response-body	https://clients2.google.com/service/update2/crx
https://accounts.google.com	https://api.dropboxapi.com
https://chromewebstore.google.com	https://clouderrorreporting.googleapis.com
https://docs.google.com	https://sheets.googleapis.com
https://www.dropbox.com	https://www.googleapis.com
https://www.googleapis.com/auth/drive.file	https://cloud.google.com/storage/docs/exponential-backoff
https://developers.google.com/workspace/drive/api/guides/performance#partial-response	https://developers.google.com/workspace/drive/api/guides/fields-parameter
https://cloud.google.com/apis/docs/system-parameters#definitions	https://www.dropbox.com/developers/documentation/http/documentation#oauth2-token
https://www.dropbox.com/developers/documentation/http/documentation#oauth2-authorize	https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
https://www.dropbox.com/developers/documentation/http/documentation#error-handling	http://status.dropbox.com
https://community.zapier.com/how-do-i-3/google-sheets-creates-new-row-copies-formatting-from-previous-row-when-adding-manychat-options-2094	https://www.dropbox.com/oauth2/authorize?client_id=
https://www.dropbox.com/developers/documentation/http/documentation#auth-token-revoke

Raw Manifest

{
  "name": "Bookmarks Backuper",
  "icons": {
    "16": "img/icon128.png",
    "48": "img/icon128.png",
    "128": "img/icon128.png"
  },
  "action": {
    "default_popup": "popup.html",
    "default_title": "Show Bookmarks Backuper"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/drive.file"
    ],
    "client_id": "788587416670-d3i89ech7a4pv33qas2stflslookq0el.apps.googleusercontent.com"
  },
  "version": "0.2.1.2",
  "background": {
    "service_worker": "service_worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Never lose your Chrome bookmarks again!",
  "permissions": [
    "identity",
    "bookmarks",
    "storage"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "require-trusted-types-for 'script'; trusted-types 'none'; child-src 'none'; connect-src https://accounts.google.com https://api.dropboxapi.com https://chromewebstore.google.com https://clouderrorreporting.googleapis.com https://docs.google.com https://sheets.googleapis.com https://www.dropbox.com https://www.googleapis.com; default-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'none'; script-src-elem 'nonce-bb_nonce'; script-src-attr 'none'; style-src 'none'; style-src-elem 'nonce-bb_nonce'; style-src-attr 'none'; worker-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
  }
}

by ✦ Astarte

Bookmarks Backuper

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (49 total):

Raw Manifest

Detections

Manifest Findings