The extension has a substantial user base of 200,000 users and maintains a decent rating of 4.1 stars from 176 reviews, suggesting general user satisfaction. However, the lack of clear developer information and company details raises transparency concerns. CORS unblocking is a legitimate development need, but the implementation approach significantly impacts security risk.
The combination of debugger permission with broad host access creates a particularly dangerous scenario. The debugger permission allows deep system access that could be exploited to manipulate other extensions or browser functionality. The all_urls host permission means this extension can intercept and modify traffic on every website you visit. While CORS unblocking requires some network manipulation, the debugger permission seems excessive for this functionality. The storage permission, though lower risk, adds another data collection vector.
Consider running this extension in a dedicated Chrome profile used only for development work, never for personal browsing or sensitive activities. Only enable it when actively needed for development tasks, then disable immediately after. Alternative approaches include using browser developer tools' built-in CORS disabling features or local development servers with proper CORS configuration. If you must use this extension, regularly audit what data it might be storing and monitor your browsing sessions for unusual behavior.
| https://clients2.google.com/service/update2/crx | https://webextension.org/listing/access-control.html | |
| https://webbrowsertools.com/test-cors/ |
{ "name": "CORS Unblock", "icons": { "16": "/data/icons/disabled/16.png", "32": "/data/icons/disabled/32.png", "48": "/data/icons/disabled/48.png", "64": "/data/icons/disabled/64.png", "128": "/data/icons/disabled/128.png", "256": "/data/icons/disabled/256.png", "512": "/data/icons/disabled/512.png" }, "action": {}, "version": "0.5.2", "background": { "service_worker": "worker.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "__MSG_description__", "permissions": [ "storage", "declarativeNetRequest", "debugger" ], "homepage_url": "https://webextension.org/listing/access-control.html", "default_locale": "en", "host_permissions": [ "<all_urls>" ], "manifest_version": 3 }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.