[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Password Defense

Version 1.0.8 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Rating: 4.5 ★

Users: 169

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 7 total findings, including 6 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: privacy

This extension has the privacy permission. Can modify privacy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
alarms
privacy
webNavigation
storage
scripting
offscreen

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; default-src 'self'; connect-src * data: blob: filesystem:; img-src *;
sandbox: sandbox allow-scripts; script-src 'sha256-2CJto13C7lQhHpApD0uFGrC+zH0IkPGBnXMFOGJHp9o=' 'unsafe-inline'

Embedded URLs (494 total):

http://www.w3.org/2000/svg	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://github.com/emscripten-core/emscripten/wiki/Linking	http://www.example.com
https://my.aura.com/sign-in	https://my.identityguard.com/sign-in
https://mozilla.github.io/localForage/#definedriver	https://chrome.google.com
https://test.privacyshield.cyex.com	https://privacyshield.cyex.com
https://test.privacymedicalshield.cyex.com	https://privacymedicalshield.cyex.com
https://test.password.missgroup.com	https://staging.password.missgroup.com
https://password.missgroup.com	https://test.password.domene.shop
https://staging.password.domene.shop	https://password.domene.shop
https://test.password.domainkeskussafe.com	https://staging.password.domainkeskussafe.com
https://password.domainkeskussafe.com	https://test.pass.protectiv.lt
https://staging.pass.protectiv.lt	https://pass.protectiv.lt
https://test.pw.phsafe.es	https://staging.pw.phsafe.es
https://pw.phsafe.es	https://sentry.io/welcome/
https://81081b6e3e59d1440aed8e4d21652bf5@o4507273593487360.ingest.us.sentry.io/4507273596633088	https://www.pango.co/
https://privacyshield.cyex.com/faq	https://www.pango.co/legal/pango-password-defense-terms-of-service/
https://www.pango.co/legal/password-defense-privacy-policy/	https://localforage.github.io/localForage
http://docs.sentry.io/platforms/javascript/configuration/transports/#offline-caching	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/privacy/services
https://github.com/getsentry/sentry/blob/master/src/sentry/lang/javascript/processor.py#L67	https://github.com/getsentry/sentry-javascript/pull/8981
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error/cause	https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues#typedarray
https://github.com/getsentry/sentry-javascript/issues/8935	http://stackoverflow.com/questions/105034/how-to-create-a-guid-uuid-in-javascript/2117523#2117523
https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string	https://github.com/getsentry/sentry-javascript/issues/2286
https://github.com/getsentry/sentry-javascript/issues/5459	https://github.com/getsentry/sentry-javascript/issues/7813
https://developer.mozilla.org/en-US/docs/Web/API/Performance	https://github.com/getsentry/sentry-javascript/issues/2590
https://github.com/mdn/content/issues/4713	https://dev.to/noamr/when-a-millisecond-is-not-a-millisecond-3h6
https://github.com/getsentry/sentry-javascript/issues/2590.	https://github.com/blueimp/JavaScript-MD5
https://blueimp.net	https://opensource.org/licenses/MIT
http://pajhome.org.uk/crypt/md5	https://github.com/zloirock/core-js/blob/1b944df55282cdc99c90db5f49eb0b6eda2cc0a3/packages/core-js/internals/global.js
https://caniuse.com/#feat=referrer-policy	https://github.com/getsentry/raven-js/issues/1233
https://github.com/uuidjs/uuid/pull/434	https://www.w3.org/TR/baggage/#limits
https://github.com/pouchdb/pouchdb/issues/5572	https://github.com/localForage/localForage/issues/856
https://github.com/mozilla/localForage/issues/128	https://github.com/mozilla/localForage/issues/272
https://github.com/mozilla-b2g/gaia	http://stackoverflow.com/questions/14967647/
https://code.google.com/p/chromium/issues/detail?id=408120	https://code.google.com/p/chromium/issues/detail?id=447916
https://code.google.com/p/chromium/issues/detail?id=447836	https://github.com/pouchdb/pouchdb/blob/master/packages/node_modules/pouchdb-adapter-idb/src/blobSupport.js
https://msdn.microsoft.com/en-us/library/hh869301%28v=vs.85%29.aspx	https://github.com/mozilla/localForage/issues/161
https://github.com/niklasvh/base64-arraybuffer	https://github.com/mozilla/localForage/pull/42
https://www.w3.org/TR/webdatabase/#databases	https://tools.ietf.org/html/rfc3986#appendix-B
https://develop.sentry.dev/sdk/data-handling/#structuring-data	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/AggregateError
https://github.com/getsentry/sentry-javascript/issues/2572.	https://github.com/getsentry/sentry-javascript/issues/4642

Page 1 of 7

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlc/gZwTRK+wrEbAYXcHmwE1uBI+Xg6PIzNm416fhp6zaZygq3naiN8/gjqi8yWRQbH/RllYu5+RHTOE6RYgPwoUrjsjD6i6uMMMr+joQ/X/iL7enR54wWj6KfFmuDm09j80dyywpvkSZZFHrcAOq9nvhzt8UgqvH+4kw0QFBcENYMYUUCR66zK6x7H69F9SnzvXjoc+nqOqY/KgjUJDfRLkBZdl4zeqsSurXdEIcHtxm/a9roEOLNpO0O4ljo6tu0/GxpPtdXigdnPKT3eOpbBt+W33/WpJYrkzBvBTEcG0Ptu3fai5wEqWCol+i802MmTPIfIrkeTmRWeiJPozYyQIDAQAB",
  "name": "Password Defense",
  "icons": {
    "16": "images/store-icon-16.png",
    "48": "images/store-icon-48.png",
    "128": "images/store-icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/action-icon/active_16.png",
      "32": "images/action-icon/active_32.png",
      "64": "images/action-icon/active_64.png"
    },
    "default_popup": "",
    "default_title": "Password Defense"
  },
  "author": "Pango Group",
  "version": "1.0.8",
  "incognito": "spanning",
  "background": {
    "service_worker": "js/background-chrome.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Password Defense secures your passwords and helps you browse online more securely and privately.",
  "permissions": [
    "tabs",
    "alarms",
    "privacy",
    "webNavigation",
    "storage",
    "scripting",
    "offscreen"
  ],
  "content_scripts": [
    {
      "js": [
        "js/main-app-content-chrome.js"
      ],
      "css": [
        "css/fonts/style.css"
      ],
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false
    },
    {
      "js": [
        "js/other-content-chrome.js"
      ],
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "109",
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'sha256-2CJto13C7lQhHpApD0uFGrC+zH0IkPGBnXMFOGJHp9o=' 'unsafe-inline'",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; default-src 'self'; connect-src * data: blob: filesystem:; img-src *;"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "images/*.png",
        "images/*.jpg",
        "images/*.svg",
        "fonts/*.woff",
        "fonts/*.woff2",
        "videos/*.mp4",
        "_locales/**/*.json",
        "css/**/*.css",
        "js/*.js",
        "js/*.js.map",
        "html/*.html"
      ]
    }
  ]
}

by ✦ Astarte

Password Defense

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (494 total):

Raw Manifest

Detections

Manifest Findings