[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

AllDebrid Extension

Version 12.0.1 View in Chrome Web Store

Last scanned: about 8 hours ago

Extension Details

Developer: https://alldebrid.fr/

Rating: 4.0 ★ (169 ratings)

Users: 50,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension comes from AllDebrid, a legitimate premium debrid service with 50,000 users and a 4.0 rating. The company has an established reputation in the file hosting/downloading space, which adds some credibility. However, the technical implementation raises significant security concerns that overshadow these positive trust indicators.

Concerns: The extension requests an extremely broad set of permissions that far exceed what's typically necessary for a debrid service. The combination of universal host permissions (*://*/*) with webRequest, webNavigation, tabs, and downloads permissions creates a powerful surveillance and data interception capability. The extension can monitor all web traffic, track browsing across all sites, manipulate downloads, and access sensitive tab information. The nativeMessaging permission suggests communication with external applications, adding another attack vector. These permissions collectively enable comprehensive user monitoring and potential data exfiltration.

Recommendations: Given the critical risk level, install this extension only in a completely separate Chrome profile isolated from personal browsing and sensitive accounts. Never use the same profile for banking, email, or other confidential activities. Consider whether the debrid functionality is worth the extensive privacy trade-offs. Monitor network traffic when the extension is active and regularly review what data might be accessible. Alternative debrid solutions with more limited permissions should be evaluated. If you must use this extension, disable it when not actively needed and consider using it only on a dedicated machine for downloading activities.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

alarms
scripting
tabs
notifications
contextMenus
webRequest
webNavigation
storage
nativeMessaging
sidePanel
downloads

Host Permissions:

*://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (58 total):

https://api.alldebrid.com/	https://apislow.alldebrid.com/
https://alldebrid.com/register/	http://docs.alldebrid.com/
https://alldebrid.com/extensions/?platform=streaming	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
https://github.com/pimterry/loglevel	https://github.com/slevithan/xregexp/pull/163
http://unicode.org/reports/tr18/#Categories.	http://unicode.org/reports/tr44/#GC_Values_Table
http://unicode.org/reports/tr18/#RL1.2	http://unicode.org/reports/tr44/
https://github.com/tc39/proposal-regexp-named-groups	http://xregexp.com/api/
http://www.google.com/	https://tc39.github.io/proposal-regexp-named-groups/#sec-regexpbuiltinexec
https://github.com/zloirock/core-js/issues/86#issuecomment-115759028	https://clients2.google.com/service/update2/crx
https://alldebrid.com/privacy/	https://docs.alldebrid.com/v4/#general-informations
https://alldebrid.com	https://help.alldebrid.com/en/Alldebrid%20tools/streaming
http://alldebrid.com/account/	https://help.alldebrid.com/fr/Outils%20Alldebrid/streaming
https://grsmto.github.io/simplebar/	https://tc39.github.io/ecma262/#sec-advancestringindex
https://tc39.github.io/ecma262/#sec-regexpexec	https://tc39.github.io/ecma262/#sec-string.prototype.replace
https://tc39.github.io/ecma262/#sec-regexp.prototype-@@replace	https://pastebin.com/N21QzeQA
https://tc39.github.io/ecma262/#sec-getsubstitution	https://tc39.github.io/ecma262/#sec-string.prototype.match
https://tc39.github.io/ecma262/#sec-regexp.prototype-@@match	https://github.com/felixexter/scrollbarWidth
https://lodash.com/	https://jquery.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	https://css-tricks.com/debouncing-throttling-explained-examples/
http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types	http://ecma-international.org/ecma-262/7.0/#sec-patterns
http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object	http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero
https://drafts.fxtf.org/geometry/#domrectreadonly	https://drafts.fxtf.org/geometry/#dictdef-domrectinit
https://github.com/KingSora/OverlayScrollbars/blob/master/js/OverlayScrollbars.js#L1634	https://alldebrid.com/account/
https://alldebrid.com/offer/	https://www.google.com/s2/favicons?domain=
https://help.alldebrid.com/en/	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/notifications/NotificationOptions
https://bugzilla.mozilla.org/show_bug.cgi?id=1280370#c38	https://fontawesome.com
https://fontawesome.com/license	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink

Raw Manifest

{
  "name": "__MSG_Ext_Name__",
  "icons": {
    "48": "img/icon.png"
  },
  "action": {
    "default_icon": "img/icon.png",
    "default_popup": "popup/popup.html",
    "default_title": "__MSG_Ext_Name__"
  },
  "version": "12.0.1",
  "background": {
    "service_worker": "worker.js"
  },
  "side_panel": {
    "default_path": "sidebar/sidebar.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_Ext_Description__",
  "permissions": [
    "alarms",
    "scripting",
    "tabs",
    "notifications",
    "contextMenus",
    "webRequest",
    "webNavigation",
    "storage",
    "nativeMessaging",
    "sidePanel",
    "downloads"
  ],
  "default_locale": "en",
  "host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "img/*",
        "content-scripts/*",
        "web-scripts/*",
        "popup/*",
        "sidebar/*",
        "webfonts/*"
      ]
    }
  ]
}

by ✦ Astarte

AllDebrid Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (58 total):

Raw Manifest

Detections

Manifest Findings