[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

X Pixel Helper

Version 3.0.4 View in Chrome Web Store

Last scanned: 18 days ago | force re-scan

Extension Details

Rating: 3.5 ★ (22 ratings)

Users: 60,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension has a modest user base of 60,000 users but concerning trust indicators including a low rating of 3.5 stars from only 22 reviews, missing author information, and no clear developer details. The lack of transparency about the developer raises immediate red flags.

Concerns: This extension exhibits multiple high-risk characteristics that are disproportionate to its stated purpose as a "pixel helper." The combination of tabs, webRequest, and broad host permissions creates a powerful surveillance toolkit. The webRequest permission allows interception and modification of all web traffic, while broad content script injection enables the extension to read sensitive data from any website including banking, email, and social media platforms. The storage permission compounds privacy risks by allowing persistent data collection. Most concerning is the lack of clear justification for why a pixel helper would need such extensive access to web requests and tab information.

Recommendations: Do not install this extension due to its critical risk level. If pixel tracking functionality is genuinely needed, seek alternatives from established developers with transparent privacy policies and more limited permissions. If you must use this extension, run it in a completely isolated Chrome profile with no access to sensitive accounts, regularly clear stored data, and monitor network traffic for suspicious activity. Consider using browser security extensions that can audit and block malicious behavior.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
storage
scripting
webRequest

Host Permissions:

<all_urls>

Embedded URLs (20 total):

https://ads.x.com/terms/	https://x.com/privacy
https://static.ads-twitter.com	https://ads-twitter.com
https://ads-api.twitter.com	https://analytics.twitter.com
https://handlebarsjs.com/api-reference/runtime-options.html#options-to-control-prototype-access	https://analytics.twitter.com/i/adsct
https://analytics.x.com/i/adsct	https://analytics.twitter.com/1/i/adsct
https://analytics.x.com/1/i/adsct	https://support.twitter.com
https://business.twitter.com/en/help/campaign-measurement-and-analytics/pixel-helper.html	https://analytics.twitter.com/12/web_event_tags/
https://static.ads-twitter.com/uwt.js	https://www.googletagmanager.com
https://analytics.x.com	http://www.w3.org/2000/svg
https://clients2.google.com/service/update2/crx	https://business.x.com/en/help/campaign-measurement-and-analytics/pixel-helper.html

Raw Manifest

{
  "name": "X Pixel Helper",
  "icons": {
    "128": "icon.png"
  },
  "action": {
    "default_icon": {
      "128": "icon.png"
    },
    "default_popup": "popup.html",
    "default_title": "There is a X website tag on this page"
  },
  "version": "3.0.4",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Displays an icon if there is a X website tag on a given page",
  "permissions": [
    "tabs",
    "storage",
    "scripting",
    "webRequest"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3
}

by ✦ Astarte

X Pixel Helper

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (20 total):

Raw Manifest

Detections

Manifest Findings