[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Handsfree for Web - Voice Control

Version 3.8.0 View in Chrome Web Store

Last scanned: about 8 hours ago

Extension Details

Developer: http://handsfreeforweb.com/

Rating: 4.4 ★ (48 ratings)

Users: 2,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 10 total findings, including 7 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

High-Risk Permission: bookmarks

This extension has the bookmarks permission. Can access and modify bookmarks. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
activeTab
bookmarks
clipboardRead
clipboardWrite
downloads
history
tabs
topSites
unlimitedStorage

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self';
sandbox: sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline'; child-src 'self';

Embedded URLs (452 total):

http://fontawesome.io	http://fontawesome.io/license
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
https://lodash.com/	https://openjsf.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
https://npms.io/search?q=ponyfill.	https://github.com/facebook/regenerator/blob/main/LICENSE
http://facebook.github.io/react/docs/error-decoder.html?invariant=	https://jquery.com/
https://jquery.org/license	http://jedwatson.github.io/classnames
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	https://google.com
https://handsfreeforweb.com/hfw-assets/audio.mp3	https://handsfreeforweb.com/hfw-assets/image.png
https://handsfreeforweb.com/hfw-assets/video.mp4	https://duckduckgo.com/?q=%5C
https://www.google.com/search?q=	http://www.w3.org/1999/xlink
http://fb.me/use-check-prop-types	http://www.w3.org/XML/1998/namespace
https://github.com/webpack-contrib/style-loader#insertat	https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
https://dbtek.github.io/bootstrap-vertical-tabs	http://cssdeck.com/uploads/media/items/8/8bcLQqF.png
https://ssl.google-analytics.com/ga.js	https://1b10a9480b0047139033f6d750701528@sentry.io/1265128
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://getbootstrap.com
https://github.com/twbs/bootstrap/blob/master/LICENSE	https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
https://chrome.google.com/webstore/detail/handsfree-for-web-voice-c/ldfboinpfdahkgnljbkohgimhimmafip	https://twitter.com/intent/tweet?text=Check%20this%20out
https://www.facebook.com/sharer/sharer.php?u=https%3A//handsfreeforweb.com	https://www.linkedin.com/shareArticle?mini=true&url=https%3A//handsfreeforweb.com&title=Browse%20the%20web%20hands%20free&summary=&source=https%3A//handsfreeforweb.com
https://community.handsfreeforweb.com/	https://www.handsfreeforweb.com/es/docs/
https://www.handsfreeforweb.com/en/docs/voice-commands-modules.html	https://twitter.com/search?q=%23handsfreeForWebRelease&src=typd
https://handsfreeforweb.com	http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
https://stackoverflow.com/q/181348	https://en.wikipedia.org/wiki/ISO_week_date#Calculating_a_date_given_the_year.2C_week_number_and_weekday
https://tools.ietf.org/html/rfc2822#section-3.3	https://github.com/moment/moment/issues/1423
https://github.com/moment/moment/issues/2978	https://github.com/moment/moment/pull/1871
http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html	https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects
https://github.com/moment/moment/issues/2166	https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
http://ecma-international.org/ecma-262/7.0/#sec-patterns	http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components
https://en.wikipedia.org/wiki/Combining_Diacritical_Marks	https://en.wikipedia.org/wiki/Combining_Diacritical_Marks_for_Symbols
https://mathiasbynens.be/notes/javascript-unicode	http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero
https://bugs.webkit.org/show_bug.cgi?id=156034	https://en.wikipedia.org/wiki/Exponentiation_by_squaring
https://mdn.io/clearTimeout	https://github.com/jashkenas/underscore/pull/1247
https://bugs.chromium.org/p/v8/issues/detail?id=90	http://ecma-international.org/ecma-262/7.0/#sec-ecmascript-function-objects-call-thisargument-argumentslist
https://es5.github.io/#x13.2.2	https://mdn.io/round#Examples
http://www.ecma-international.org/ecma-262/7.0/#sec-regexp.prototype.tostring	http://ecma-international.org/ecma-262/7.0/#sec-object.keys
https://bugs.chromium.org/p/v8/issues/detail?id=2070	https://mdn.io/setTimeout

Page 1 of 6

Raw Manifest

{
  "name": "__MSG_name__",
  "icons": {
    "16": "icons/icon16x16.png",
    "20": "icons/icon20x20.png",
    "24": "icons/icon24x24.png",
    "32": "icons/icon32x32.png",
    "64": "icons/icon64x64.png",
    "128": "icons/icon128x128.png",
    "256": "icons/icon256x256.png",
    "512": "icons/icon512x512.png"
  },
  "action": {
    "default_icons/icon": {
      "16": "icons/icon16x16.png",
      "20": "icons/icon20x20.png",
      "24": "icons/icon24x24.png",
      "32": "icons/icon32x32.png",
      "64": "icons/icon64x64.png",
      "128": "icons/icon128x128.png",
      "256": "icons/icon256x256.png",
      "512": "icons/icon512x512.png"
    }
  },
  "author": "Javier Perez",
  "version": "3.8.0",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "short_name": "__MSG_shortName__",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "storage",
    "activeTab",
    "bookmarks",
    "clipboardRead",
    "clipboardWrite",
    "downloads",
    "history",
    "tabs",
    "topSites",
    "unlimitedStorage"
  ],
  "homepage_url": "https://www.handsfreeforweb.com",
  "options_page": "docs.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "css": [
        "body.css"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "match_about_blank": true
    }
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "88",
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline'; child-src 'self';",
    "extension_pages": "script-src 'self'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "app.css",
        "speech-recognizer.html",
        "native-commands-handler.js",
        "font-awesome/fontawesome-webfont.eot",
        "font-awesome/fontawesome-webfont.woff2",
        "font-awesome/fontawesome-webfont.woff",
        "font-awesome/fontawesome-webfont.ttf",
        "font-awesome/fontawesome-webfont.svg"
      ]
    }
  ]
}

by ✦ Astarte

Handsfree for Web - Voice Control

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (452 total):

Raw Manifest

Detections

Manifest Findings