[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Swift Snake 3D [Popup]

Version 3.001 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: https://www.oktaycomu.com/

Rating: 3.5 ★ (13 ratings)

Users: 1,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a modest user base of 1,000 users with a moderate rating of 3.5 stars from 13 reviews, indicating limited but mixed user feedback. The developer provides a website (oktaycomu.com) which adds some transparency. However, the lack of recent update information and relatively small user base suggests limited ongoing support or popularity.

Concerns: The extension uses the older Manifest V2, which has weaker security protections compared to the current V3 standard. While the storage permission is appropriate for a game that likely needs to save progress and settings, the combination of older manifest version and limited user feedback raises some caution. The Content Security Policy appears reasonable, restricting script sources to self and Google APIs only.

Recommendations: This appears to be a simple 3D Snake game with reasonable permissions for its functionality. The medium risk primarily stems from the outdated manifest version rather than malicious intent. You can safely use this extension, but consider running it in a separate Chrome profile if you're particularly security-conscious. Monitor for any unusual behavior and consider switching to a similar game extension that uses Manifest V3 when available. The limited permissions and clear gaming purpose make it relatively low-risk for typical use.

Findings

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

storage

Content Security Policy:

script-src 'self' https://apis.google.com; object-src 'self'

Embedded URLs (45 total):

https://getbootstrap.com/	https://github.com/twbs/bootstrap/blob/master/LICENSE
https://github.com/necolas/normalize.css/blob/master/LICENSE.md	http://www.w3.org/2000/svg
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.apache.org/licenses/
http://www.apache.org/licenses/LICENSE-2.0	https://preview.babylonjs.com/inspector/babylon.inspector.bundle.js
https://preview.babylonjs.com/draco_wasm_wrapper_gltf.js	https://preview.babylonjs.com/draco_decoder_gltf.wasm
https://preview.babylonjs.com/draco_decoder_gltf.js	http://doc.babylonjs.com/how_to/load_from_any_file_type
https://controllers.babylonjs.com/oculus/	https://controllers.babylonjs.com/vive/
https://controllers.babylonjs.com/generic/	https://controllers.babylonjs.com/microsoft/
https://assets.babylonjs.com/environments/backgroundGround.png	https://assets.babylonjs.com/environments/backgroundSkybox.dds
https://assets.babylonjs.com/environments/environmentSpecular.env	https://www.babylonjs.com/assets/Flare.png
https://assets.babylonjs.com/particles	https://github.com/twbs/bootstrap/graphs/contributors
https://popper.js.org	https://securetoken.googleapis.com/v1/token
https://www.googleapis.com/identitytoolkit/v3/relyingparty/	https://apis.google.com/js/client.js?onload=%
https://staging-www.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/	https://staging-securetoken.sandbox.googleapis.com/v1/token
https://www-googleapis-test.sandbox.google.com/identitytoolkit/v3/relyingparty/	https://test-securetoken.sandbox.googleapis.com/v1/token
https://apis.google.com/js/api.js?onload=%	https://www.google.com/recaptcha/api.js?onload=%
https://snake-leaderboard.herokuapp.com/	https://www.oktaycomu.com/about.php
https://stackoverflow.com/questions/15775187/how-to-cause-a-chrome-app-to-update-as-soon-as-possible	https://snake-leaderboard-v2.herokuapp.com/
https://www.oktaycomu.com/swiftSnake	http://opensource.org/licenses/MIT
https://swift-snake.firebaseio.com	https://clients2.google.com/service/update2/crx
https://apis.google.com	https://developer.chrome.com/extensions/tabs#method-query
https://developer.chrome.com/extensions/tabs#type-Tab	https://developers.google.com/image-search/
https://ajax.googleapis.com/ajax/services/search/images

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjKL3HDh6AlkW9MR8e1do7c+I4cygUxgk1Si6kvlSyp4qDSH09KyA7ptdZ6KhHI5tRYP87o0uQCjjTpQZGm6b4YoU4medc2jMkHk1sGye2R/Um4zjWDV/W/6Dlg3zi9mxrbuA2FGFI4OfqrdI0fv1cn+xAN2qBhhbbdF6XDz1TI9ZcHF/Me6sAiWLZAi2wgS3fM6y1eNyQsZPLsvN9UIKqzG26VUy+BALXHO5wX5NkwaWv5WSLGIY9sk55desOwSw1dmxdI5ZzE0CPFVoJ0sgHHgTbCv8YYdVwmdTmGMhsAiC7rT4fxXFR1upDhjnzcgAXmiH9eAI+txnx9vQT7nzfQIDAQAB",
  "name": "Swift Snake 3D [Popup]",
  "icons": {
    "16": "assets/snake_icon_16.png",
    "128": "assets/snake_icon_128.png"
  },
  "version": "3.001",
  "background": {
    "scripts": [
      "js/jquery.js"
    ]
  },
  "short_name": "Swift Snake",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Lets you play snake in 3D and in hyper speed whenever you want...",
  "permissions": [
    "storage"
  ],
  "browser_action": {
    "default_icon": "assets/snake_icon_128.png",
    "default_popup": "index.html"
  },
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' https://apis.google.com; object-src 'self'"
}

by ✦ Astarte

Swift Snake 3D [Popup]

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (45 total):

Raw Manifest

Detections

Manifest Findings