[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Swift Snake 3D [Popup]

Version 3.001 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: https://www.oktaycomu.com/

Rating: 3.5 ★ (13 ratings)

Users: 990

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a relatively small user base of 990 users with a moderate rating of 3.5 stars from only 13 reviews, which limits confidence in its reliability. The developer provides a website (oktaycomu.com) which adds some legitimacy, though the limited user feedback makes it difficult to assess overall trustworthiness.

Concerns: The extension uses the older Manifest V2, which has weaker security protections compared to the current V3 standard. While the storage permission is reasonable for a game that likely needs to save progress and settings, the low number of ratings suggests limited community vetting. The Content Security Policy appears appropriately restrictive, limiting script sources to self and Google APIs.

Recommendations: Given the medium risk level, you could safely use this extension in your main browser profile, but consider these precautions: Monitor the extension's behavior after installation and be cautious about any unexpected requests or changes to your browser. Since it's a simple popup game, the storage permission should only be used for game-related data like high scores or settings. If you're particularly security-conscious, you could run it in a separate Chrome profile, though this may be unnecessary for a basic game extension with minimal permissions.

Findings

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

storage

Content Security Policy:

script-src 'self' https://apis.google.com; object-src 'self'

Embedded URLs (45 total):

https://getbootstrap.com/	https://github.com/twbs/bootstrap/blob/master/LICENSE
https://github.com/necolas/normalize.css/blob/master/LICENSE.md	http://www.w3.org/2000/svg
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.apache.org/licenses/
http://www.apache.org/licenses/LICENSE-2.0	https://preview.babylonjs.com/inspector/babylon.inspector.bundle.js
https://preview.babylonjs.com/draco_wasm_wrapper_gltf.js	https://preview.babylonjs.com/draco_decoder_gltf.wasm
https://preview.babylonjs.com/draco_decoder_gltf.js	http://doc.babylonjs.com/how_to/load_from_any_file_type
https://controllers.babylonjs.com/oculus/	https://controllers.babylonjs.com/vive/
https://controllers.babylonjs.com/generic/	https://controllers.babylonjs.com/microsoft/
https://assets.babylonjs.com/environments/backgroundGround.png	https://assets.babylonjs.com/environments/backgroundSkybox.dds
https://assets.babylonjs.com/environments/environmentSpecular.env	https://www.babylonjs.com/assets/Flare.png
https://assets.babylonjs.com/particles	https://github.com/twbs/bootstrap/graphs/contributors
https://popper.js.org	https://securetoken.googleapis.com/v1/token
https://www.googleapis.com/identitytoolkit/v3/relyingparty/	https://apis.google.com/js/client.js?onload=%
https://staging-www.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/	https://staging-securetoken.sandbox.googleapis.com/v1/token
https://www-googleapis-test.sandbox.google.com/identitytoolkit/v3/relyingparty/	https://test-securetoken.sandbox.googleapis.com/v1/token
https://apis.google.com/js/api.js?onload=%	https://www.google.com/recaptcha/api.js?onload=%
https://snake-leaderboard.herokuapp.com/	https://www.oktaycomu.com/about.php
https://stackoverflow.com/questions/15775187/how-to-cause-a-chrome-app-to-update-as-soon-as-possible	https://snake-leaderboard-v2.herokuapp.com/
https://www.oktaycomu.com/swiftSnake	http://opensource.org/licenses/MIT
https://swift-snake.firebaseio.com	https://clients2.google.com/service/update2/crx
https://apis.google.com	https://developer.chrome.com/extensions/tabs#method-query
https://developer.chrome.com/extensions/tabs#type-Tab	https://developers.google.com/image-search/
https://ajax.googleapis.com/ajax/services/search/images

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjKL3HDh6AlkW9MR8e1do7c+I4cygUxgk1Si6kvlSyp4qDSH09KyA7ptdZ6KhHI5tRYP87o0uQCjjTpQZGm6b4YoU4medc2jMkHk1sGye2R/Um4zjWDV/W/6Dlg3zi9mxrbuA2FGFI4OfqrdI0fv1cn+xAN2qBhhbbdF6XDz1TI9ZcHF/Me6sAiWLZAi2wgS3fM6y1eNyQsZPLsvN9UIKqzG26VUy+BALXHO5wX5NkwaWv5WSLGIY9sk55desOwSw1dmxdI5ZzE0CPFVoJ0sgHHgTbCv8YYdVwmdTmGMhsAiC7rT4fxXFR1upDhjnzcgAXmiH9eAI+txnx9vQT7nzfQIDAQAB",
  "name": "Swift Snake 3D [Popup]",
  "icons": {
    "16": "assets/snake_icon_16.png",
    "128": "assets/snake_icon_128.png"
  },
  "version": "3.001",
  "background": {
    "scripts": [
      "js/jquery.js"
    ]
  },
  "short_name": "Swift Snake",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Lets you play snake in 3D and in hyper speed whenever you want...",
  "permissions": [
    "storage"
  ],
  "browser_action": {
    "default_icon": "assets/snake_icon_128.png",
    "default_popup": "index.html"
  },
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' https://apis.google.com; object-src 'self'"
}

by ✦ Astarte

Swift Snake 3D [Popup]

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (45 total):

Raw Manifest

Detections

Manifest Findings