[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Take Webpage Screenshots Entirely - FireShot

Version 2.1.4.18 View in Chrome Web Store

Last scanned: about 17 hours ago

Extension Details

Developer: https://getfireshot.com/

Rating: 4.8 ★ (51.9K ratings)

Users: 3,000,000

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 4 total findings, including 1 high-risk finding.

Findings

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
alarms
scripting
activeTab
nativeMessaging
contextMenus

Optional Permissions:

tabs
downloads

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self';

Embedded URLs (133 total):

http://bootswatch.com	http://getbootstrap.com
https://github.com/twbs/bootstrap/blob/master/LICENSE	http://www.w3.org/2000/svg%27%3E%3Cpath
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/2000/svg
https://getfireshot.com/features.php	https://getfireshot.com/buy.php?SRC=APPID-lite&ver=VERID
https://getfireshot.com	https://getfireshot.com/get/chrome
https://getfireshot.com/get/firefox	https://getfireshot.com/get/edge
https://getfireshot.com/get/opera	https://getfireshot.com/get/safari
https://getfireshot.com?from=APPID	https://chrome.google.com/webstore/detail/capture-webpage-screensho/mcbpblocgmgfnpjjppndjkmgjaogfceg
https://chrome.google.com/webstore/detail/capture-webpage-screensho/mcbpblocgmgfnpjjppndjkmgjaogfceg/reviews	https://addons.mozilla.org/firefox/addon/fireshot
https://addons.mozilla.org/firefox/addon/fireshot/reviews/	https://getfireshot.com/privacy.php
http://blog.chromium.org/2013/09/saying-goodbye-to-our-old-friend-npapi.html	https://getfireshot.com/demos/how-to-make-delayed-screenshot.php
https://support.mozilla.org/en-US/kb/manage-extension-shortcuts-firefox	https://getfireshot.com/api.php
https://developer.chrome.com/extensions/permission_warnings	http://www.w3.org/1999/xlink
http://svgjs.com/svgjs	https://clients2.google.com/service/update2/crx
https://mail.google.com/	https://api.inboxsdk.com/api/v2/errors
https://mail.google.com	https://people-pa.clients6.google.com/
https://mail.google.com/sync	https://register.inboxsdk.com/
https://www.inboxsdk.com/docs/#Router	https://myaccount.google.
https://www.gstatic.com/images/icons/material/system_gm/2x/more_vert_black_20dp.png	https://mail.google.com/mail
https://mail.google.com/mail/u/0/	https://ssl.gstatic.com/ui/v1/icons/common/x_8px.png
https://api.inboxsdk.com/api/v2/events/oauth	https://pubsub.googleapis.com/v1/projects/mailfoogae/topics/events:publish?key=
https://github.com/InboxSDK/InboxSDK/issues/1062#issuecomment-1821327292	https://www.inboxsdk.com/docs/#RequiredSetup
https://www.gstatic.com/images/icons/material/system/1x/close_black_24dp.png	https://www.gstatic.com/images/icons/material/system/2x/close_black_24dp.png
https://ssl.gstatic.com/mail/sprites/smartmail-561acb673be75c1d374881a95997fce4.png	https://feross.org
http://jedwatson.github.io/classnames	https://feross.org/opensource
https://github.com/kefirjs/kefir	https://github.com/kefirjs/kefir/issues/145
https://github.com/kefirjs/kefir/issues/149	https://github.com/kefirjs/kefir/issues/150
http://fb.me/use-check-prop-types	https://fb.me/react-warning-dont-call-proptypes
http://www.w3.org/XML/1998/namespace	https://reactjs.org/link/controlled-components
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
https://reactjs.org/link/dangerously-set-inner-html	https://reactjs.org/link/invalid-aria-props
https://reactjs.org/link/attribute-behavior	https://reactjs.org/link/crossorigin-error
https://reactjs.org/link/profiling	https://reactjs.org/link/react-devtools
https://reactjs.org/link/unsafe-component-lifecycles	https://reactjs.org/link/derived-state
https://reactjs.org/link/legacy-context	https://reactjs.org/link/warning-keys
https://reactjs.org/link/strict-mode-string-ref	https://reactjs.org/link/refs-must-have-owner
https://reactjs.org/link/rules-of-hooks	https://reactjs.org/link/invalid-hook-call
https://reactjs.org/link/error-boundaries	https://reactjs.org/link/hooks-data-fetching
https://reactjs.org/link/setstate-in-render	https://reactjs.org/link/wrap-tests-with-act
https://reactjs.org/link/mock-scheduler	https://reactjs.org/link/strict-mode-find-node

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_application_title__",
  "icons": {
    "16": "images/sss_16.png",
    "32": "images/sss_32.png",
    "48": "images/sss_48.png",
    "128": "images/sss_128.png"
  },
  "action": {
    "default_popup": "fsPopup.html"
  },
  "version": "2.1.4.18",
  "commands": {
    "last-used-action": {
      "description": "__MSG_options_label_last_action_hotkey__",
      "suggested_key": {
        "mac": "Command+Shift+S",
        "default": "Ctrl+Shift+S"
      }
    },
    "capture-selection-action": {
      "description": "__MSG_action_capture_selection_lite__",
      "suggested_key": {
        "mac": "Command+Shift+6",
        "default": "Alt+Shift+4"
      }
    },
    "capture-entire-page-action": {
      "description": "__MSG_action_capture_entire_lite__",
      "suggested_key": {
        "mac": "Command+Shift+1",
        "default": "Alt+Shift+1"
      }
    },
    "capture-visible-page-action": {
      "description": "__MSG_action_capture_visible_lite__",
      "suggested_key": {
        "mac": "Command+Shift+2",
        "default": "Alt+Shift+3"
      }
    }
  },
  "incognito": "spanning",
  "background": {
    "service_worker": "scripts/fsServiceWorker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_application_description__",
  "permissions": [
    "storage",
    "alarms",
    "scripting",
    "activeTab",
    "nativeMessaging",
    "contextMenus"
  ],
  "options_page": "fsOptions.html",
  "default_locale": "en",
  "offline_enabled": true,
  "manifest_version": 3,
  "optional_permissions": [
    "tabs",
    "downloads"
  ],
  "externally_connectable": {
    "matches": [
      "https://*.getfireshot.com/*"
    ]
  },
  "minimum_chrome_version": "114",
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://*.getfireshot.com/*"
      ],
      "resources": [
        "fsWidget.html",
        "fsCaptured.html"
      ]
    }
  ],
  "optional_host_permissions": [
    "https://mail.google.com/*",
    "<all_urls>"
  ]
}

by ✦ Astarte

Take Webpage Screenshots Entirely - FireShot

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Content Security Policy:

Embedded URLs (133 total):

Raw Manifest

Detections

Manifest Findings