Starting analysis...
The extension has a substantial user base of 200,000 users and maintains a decent 4.1-star rating from 176 reviews, suggesting general user satisfaction. However, the lack of visible developer information and company details raises transparency concerns. CORS (Cross-Origin Resource Sharing) unblocking is a legitimate developer tool need, which provides some context for the broad permissions.
The combination of debugger permission with all_urls host access creates a particularly potent security risk profile. The debugger permission allows deep system access that could be exploited to manipulate other extensions or browser functionality. The broad host permissions enable the extension to intercept and modify network requests across all websites, creating opportunities for data theft or malicious injection. While storage permission is relatively benign, it allows persistent data collection. The technical nature of CORS manipulation means this extension operates at a low level that could bypass normal browser security mechanisms.
Consider running this extension in a dedicated Chrome profile isolated from personal browsing and sensitive accounts. Only enable it when actively needed for development work, then disable it immediately after use. Regularly review the extension's network activity and consider alternative CORS solutions like local development servers with proper CORS headers. Monitor for any unusual browser behavior when the extension is active, and keep it updated to the latest version.
| https://clients2.google.com/service/update2/crx | https://webextension.org/listing/access-control.html | |
| https://webbrowsertools.com/test-cors/ |
{ "name": "CORS Unblock", "icons": { "16": "/data/icons/disabled/16.png", "32": "/data/icons/disabled/32.png", "48": "/data/icons/disabled/48.png", "64": "/data/icons/disabled/64.png", "128": "/data/icons/disabled/128.png", "256": "/data/icons/disabled/256.png", "512": "/data/icons/disabled/512.png" }, "action": {}, "version": "0.5.2", "background": { "service_worker": "worker.js" }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "__MSG_description__", "permissions": [ "storage", "declarativeNetRequest", "debugger" ], "homepage_url": "https://webextension.org/listing/access-control.html", "default_locale": "en", "host_permissions": [ "<all_urls>" ], "manifest_version": 3 }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.