[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

AllDebrid Extension

Version 12.0.1 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: https://alldebrid.fr/

Rating: 4.0 ★ (168 ratings)

Users: 50,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension is developed by AllDebrid, a legitimate premium download service with a known website (alldebrid.fr). With 50,000 users and a 4.0 rating from 168 reviews, it shows moderate adoption and user satisfaction. However, the developer information is minimal, which reduces transparency.

Concerns: The extension requests extremely broad permissions that far exceed what's typically needed for a download service integration. The combination of tabs, webRequest, webNavigation, and universal host permissions (*://*/*) creates a powerful surveillance capability that could monitor all browsing activity and intercept sensitive data across every website visited. The downloads permission, while expected for this type of service, combined with scripting and nativeMessaging permissions, could potentially be exploited to execute malicious code or exfiltrate files. The webRequest permission is particularly concerning as it allows modification of network traffic.

Recommendations: Given the critical risk level, avoid installing this extension on your primary browser profile. If you must use it, create a dedicated Chrome profile specifically for AllDebrid activities and limit browsing to only necessary sites while the extension is active. Consider using AllDebrid's web interface instead of the extension, or look for alternative download managers with more restrictive permissions. Regularly audit what data the extension might be accessing and consider the trade-off between convenience and privacy.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

alarms
scripting
tabs
notifications
contextMenus
webRequest
webNavigation
storage
nativeMessaging
sidePanel
downloads

Host Permissions:

*://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (58 total):

https://api.alldebrid.com/	https://apislow.alldebrid.com/
https://alldebrid.com/register/	http://docs.alldebrid.com/
https://alldebrid.com/extensions/?platform=streaming	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
https://github.com/pimterry/loglevel	https://github.com/slevithan/xregexp/pull/163
http://unicode.org/reports/tr18/#Categories.	http://unicode.org/reports/tr44/#GC_Values_Table
http://unicode.org/reports/tr18/#RL1.2	http://unicode.org/reports/tr44/
https://github.com/tc39/proposal-regexp-named-groups	http://xregexp.com/api/
http://www.google.com/	https://tc39.github.io/proposal-regexp-named-groups/#sec-regexpbuiltinexec
https://github.com/zloirock/core-js/issues/86#issuecomment-115759028	https://clients2.google.com/service/update2/crx
https://alldebrid.com/privacy/	https://docs.alldebrid.com/v4/#general-informations
https://alldebrid.com	https://help.alldebrid.com/en/Alldebrid%20tools/streaming
http://alldebrid.com/account/	https://help.alldebrid.com/fr/Outils%20Alldebrid/streaming
https://grsmto.github.io/simplebar/	https://tc39.github.io/ecma262/#sec-advancestringindex
https://tc39.github.io/ecma262/#sec-regexpexec	https://tc39.github.io/ecma262/#sec-string.prototype.replace
https://tc39.github.io/ecma262/#sec-regexp.prototype-@@replace	https://pastebin.com/N21QzeQA
https://tc39.github.io/ecma262/#sec-getsubstitution	https://tc39.github.io/ecma262/#sec-string.prototype.match
https://tc39.github.io/ecma262/#sec-regexp.prototype-@@match	https://github.com/felixexter/scrollbarWidth
https://lodash.com/	https://jquery.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	https://css-tricks.com/debouncing-throttling-explained-examples/
http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types	http://ecma-international.org/ecma-262/7.0/#sec-patterns
http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object	http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero
https://drafts.fxtf.org/geometry/#domrectreadonly	https://drafts.fxtf.org/geometry/#dictdef-domrectinit
https://github.com/KingSora/OverlayScrollbars/blob/master/js/OverlayScrollbars.js#L1634	https://alldebrid.com/account/
https://alldebrid.com/offer/	https://www.google.com/s2/favicons?domain=
https://help.alldebrid.com/en/	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/notifications/NotificationOptions
https://bugzilla.mozilla.org/show_bug.cgi?id=1280370#c38	https://fontawesome.com
https://fontawesome.com/license	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink

Raw Manifest

{
  "name": "__MSG_Ext_Name__",
  "icons": {
    "48": "img/icon.png"
  },
  "action": {
    "default_icon": "img/icon.png",
    "default_popup": "popup/popup.html",
    "default_title": "__MSG_Ext_Name__"
  },
  "version": "12.0.1",
  "background": {
    "service_worker": "worker.js"
  },
  "side_panel": {
    "default_path": "sidebar/sidebar.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_Ext_Description__",
  "permissions": [
    "alarms",
    "scripting",
    "tabs",
    "notifications",
    "contextMenus",
    "webRequest",
    "webNavigation",
    "storage",
    "nativeMessaging",
    "sidePanel",
    "downloads"
  ],
  "default_locale": "en",
  "host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "img/*",
        "content-scripts/*",
        "web-scripts/*",
        "popup/*",
        "sidebar/*",
        "webfonts/*"
      ]
    }
  ]
}

by ✦ Astarte

AllDebrid Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (58 total):

Raw Manifest

Detections

Manifest Findings