[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Link Grabber

Version 1.0.0 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Rating: 5.0 ★ (15 ratings)

Users: 2,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has concerning trust indicators with only 2,000 users and just 15 ratings, suggesting limited adoption and verification. While the 5.0 rating appears positive, the small sample size makes this less reliable. The lack of developer information and missing last updated date raises additional transparency concerns. The extension's name "Link Grabber" aligns with its likely functionality, but the broad permissions suggest capabilities beyond simple link extraction.

Concerns: The extension requests excessive permissions for what should be a straightforward link extraction tool. The clipboardWrite permission allows modification of clipboard content, which could be exploited to inject malicious data. The downloads permission enables file downloads and access to download history, creating potential privacy risks. Most concerning are the broad host permissions (https://*/*, http://*/*) that grant access to all websites, far exceeding what's necessary for link grabbing functionality. The combination of clipboard access, download capabilities, and universal website access creates significant potential for data exfiltration or malicious activity.

Recommendations: Consider running this extension in a separate Chrome profile to isolate potential risks. Look for alternative link grabbing extensions with more restrictive permissions and better developer transparency. If you must use this extension, monitor your clipboard content and download activity closely. Regularly review the extension's behavior and remove it if you notice any suspicious activity. Consider whether the functionality truly requires such broad permissions or if a simpler bookmarklet solution might suffice.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "icon16.plasmo.6c567d50.png",
    "32": "icon32.plasmo.76b92899.png",
    "48": "icon48.plasmo.aced7582.png",
    "64": "icon64.plasmo.8bb5e6e0.png",
    "128": "icon128.plasmo.3c1ed2d2.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.plasmo.6c567d50.png",
      "32": "icon32.plasmo.76b92899.png",
      "48": "icon48.plasmo.aced7582.png",
      "64": "icon64.plasmo.8bb5e6e0.png",
      "128": "icon128.plasmo.3c1ed2d2.png"
    },
    "default_popup": "popup.html"
  },
  "author": "cws@ershov.io",
  "version": "1.0.0",
  "background": {
    "service_worker": "static/background/index.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_shortDesc__",
  "permissions": [
    "activeTab",
    "scripting",
    "contextMenus",
    "clipboardWrite",
    "downloads",
    "storage"
  ],
  "default_locale": "en",
  "host_permissions": [
    "https://*/*",
    "http://*/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte

https://clients2.google.com/service/update2/crx	https://react.dev/errors/
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://docs.google.com/forms/d/e/1FAIpQLSf58vSBa1AuZnVbBUQp6Ccsq21VU_KMRptdie63ON8sIjTKqw/viewform?usp=pp_url&entry.1873616461=Link+Grabber	https://chromewebstore.google.com/detail/link-grabber/lnajkglgcopallcelkglibliacibpehf/reviews
https://fonts.googleapis.com/css2?family=Inter:wght@400	https://docs.google.com/forms/d/e/1FAIpQLSfIxFrW8ARUJwF-x9xYPuR7i_m6qn2U-Mjr7C32LKGlwawCqw/viewform?usp=pp_url&entry.541855317=Link+Grabber

Link Grabber

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (10 total):

Raw Manifest

Detections

Manifest Findings