[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Fingerprint Spoofer

Version 1.0.0 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Rating: 5.0 ★ (1 rating)

Users: 312

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: This extension has several concerning trust indicators. With only 312 users and a single 5-star rating, it lacks the user base and review history that would indicate reliability. The absence of clear developer information makes it difficult to verify the creator's legitimacy or track record. The extension's purpose of "fingerprint spoofing" inherently involves deceptive practices that could be used for both legitimate privacy protection and malicious activities.

Concerns:

- Extremely broad permissions that far exceed what's necessary for basic fingerprint spoofing functionality

- Access to all websites through both host permissions and content script injection creates massive attack surface

- Specific targeting of Google's reCAPTCHA systems suggests potential for bypassing security measures

- The combination of storage permissions with broad web access enables comprehensive data collection and tracking

- Lack of transparency about the developer's identity and intentions

- Low user adoption may indicate the extension hasn't been thoroughly vetted by the community

Recommendations:

Run this extension in a completely separate Chrome profile isolated from your main browsing activities. Consider using established, well-reviewed privacy tools instead. If you must use this extension, monitor your network traffic and regularly audit what data it might be collecting. Be particularly cautious when visiting sensitive sites like banking or email services while this extension is active. The broad permissions combined with the suspicious targeting of security systems make this extension unsuitable for general use.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://*.google.com/recaptcha/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
scripting
declarativeNetRequest
contentSettings

Host Permissions:

<all_urls>
*://*.google.com/recaptcha/*
*://*.recaptcha.net/recaptcha/*

Embedded URLs (66 total):

https://github.com/emscripten-core/emscripten/wiki/Linking	https://emscripten.org/docs/porting/pthreads.html#blocking-on-the-main-browser-thread
https://getbootstrap.com/	https://github.com/twbs/bootstrap/graphs/contributors
https://github.com/twbs/bootstrap/blob/main/LICENSE	https://popper.js.org
https://goo.gl/pxwQGp	https://github.com/twbs/bootstrap/issues/32273
https://www.charistheo.io/blog/2021/02/restart-a-css-animation-with-javascript/#restarting-a-css-animation	https://github.com/popperjs/popper-core/issues/1223
https://github.com/popperjs/popper-core/issues/837	https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block
https://github.com/facebook/flow/issues/1414	https://github.com/popperjs/popper-core/issues/1078
https://stackoverflow.com/questions/49875255	https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
https://developer.mozilla.org/en-US/docs/Web/API/Window/innerWidth#usage_notes	https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts
http://www.w3.org/2000/svg	https://github.com/sass/sass/issues/2383#issuecomment-336349172
https://github.com/necolas/normalize.css	https://github.com/twbs/bootstrap/issues/19402
https://github.com/twbs/bootstrap/issues/24093	https://github.com/twbs/bootstrap/pull/30562
https://github.com/twbs/bootstrap/issues/24990	https://stackoverflow.com/a/54997118
https://github.com/twbs/bootstrap/issues/12359	https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements
https://github.com/twbs/bootstrap/issues/29712	https://github.com/twbs/bootstrap/issues/18842
https://github.com/twbs/bootstrap/issues/11586.	https://rtlstyling.com/posts/rtl-styling#form-inputs
https://rtlcss.com/learn/usage-guide/control-directives/#raw	https://github.com/twbs/rfs/blob/main/LICENSE
https://github.com/twbs/rfs/issues/14	https://github.com/twbs/bootstrap/issues/18178
https://www.w3.org/TR/mediaqueries-4/#mq-min-max	https://bugs.webkit.org/show_bug.cgi?id=178261
https://github.com/react-bootstrap/react-bootstrap/issues/6039	https://github.com/philipwalton/flexbugs#flexbug-4
https://github.com/twbs/bootstrap/issues/23307	https://bugs.webkit.org/show_bug.cgi?id=198959
https://github.com/twbs/bootstrap/pull/11526.	https://github.com/twbs/bootstrap/issues/11655.
https://github.com/twbs/bootstrap/pull/29124	https://primer.github.io/.
https://github.com/twbs/bootstrap/issues/32636	https://github.com/twbs/bootstrap/issues/28247
https://stackoverflow.com/questions/36247140/why-dont-flex-items-shrink-past-content-size	https://github.com/sass/sass/issues/1873#issuecomment-152293725
https://github.com/twbs/bootstrap/pull/27703	https://github.com/twbs/bootstrap/pull/22740#issuecomment-305868106
https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile	https://github.com/twbs/bootstrap/pull/10951.
https://bugs.webkit.org/show_bug.cgi?id=158342	https://github.com/twbs/bootstrap/issues/17695
https://github.com/twbs/bootstrap/issues/24800	https://www.a11yproject.com/posts/2013-01-11-how-to-hide-content/
https://kittygiraudel.com/2016/10/13/css-hide-and-seek/	https://github.com/twbs/bootstrap/issues/25686
https://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1	https://clients2.google.com/service/update2/crx
https://fonts.googleapis.com	https://fonts.gstatic.com
https://fonts.googleapis.com/css2?family=Poppins:ital	https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css

Raw Manifest

{
  "name": "Fingerprint Spoofer",
  "icons": {
    "16": "images/fingerprint-16.png",
    "32": "images/fingerprint-32.png",
    "48": "images/fingerprint-48.png",
    "128": "images/fingerprint-128.png"
  },
  "action": {
    "default_popup": "popup.html"
  },
  "version": "1.0.0",
  "background": {
    "service_worker": "js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Automatically solve reCaptcha using AI and Spoofer browser fingerprint.",
  "permissions": [
    "storage",
    "scripting",
    "declarativeNetRequest",
    "contentSettings"
  ],
  "content_scripts": [
    {
      "js": [
        "js/recaptcha.js"
      ],
      "run_at": "document_end",
      "matches": [
        "*://*.google.com/recaptcha/api2/*",
        "*://*.google.com/recaptcha/enterprise/*",
        "*://*.recaptcha.net/recaptcha/api2/*",
        "*://*.recaptcha.net/recaptcha/enterprise/*"
      ],
      "all_frames": true,
      "match_about_blank": false
    },
    {
      "js": [
        "js/recaptcha-visibility.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": false
    }
  ],
  "host_permissions": [
    "<all_urls>",
    "*://*.google.com/recaptcha/*",
    "*://*.recaptcha.net/recaptcha/*"
  ],
  "manifest_version": 3,
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_1",
        "path": "js/rules.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "dist/*",
        "models/*",
        "js/navigatorSpoofScript.js",
        "js/canvasSpoofScript.js",
        "js/recaptcha.js",
        "js/recaptcha-visibility.js"
      ],
      "use_dynamic_url": true
    }
  ]
}

by ✦ Astarte

Fingerprint Spoofer

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (66 total):

Raw Manifest

Detections

Manifest Findings