[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

SessionBox - Multi login to any website

Version 1.8.9 View in Chrome Web Store

Last scanned: over 1 year ago | force re-scan

Extension Details

Developer: sessionbox.io

Rating: 3.3 ★ (1.4K ratings)

Size: 2.62MiB

Last Updated: September 10, 2024

Users: 200,000

Developer Info: Box Labs Kft.Nádasdy utca 15-A 2. emelet 18 Budapest 1097 HU

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

- The extension has a relatively high number of users (200,000), which could indicate some level of trust and popularity.

- However, the average rating is quite low at 3.3/5 from 1.4K reviews, suggesting potential issues or concerns from users.

- The developer information provided seems legitimate (a company based in Hungary), but further verification may be needed.

Concerns:

- This extension requests an extremely broad set of permissions, including the ability to access all websites, intercept and modify web requests/traffic, manage browser tabs and cookies, and more. Many of these permissions seem unnecessary for the stated functionality of allowing multi-login to websites.

- The combination of certain permissions (e.g., webRequest and webRequestBlocking) could potentially be used for malicious purposes, such as modifying sensitive web traffic or stealing data.

- The extension can inject scripts into any website, raising concerns about potential data theft or content modification.

- The use of an older manifest version (v2) means fewer security restrictions compared to the newer v3.

Recommendations:

- Exercise extreme caution when considering the installation of this extension, as the broad permissions and potential risks appear to outweigh the stated functionality.

- If you decide to use this extension, consider running it in a separate browser profile or a dedicated testing environment to isolate it from your primary browsing activities.

- Regularly monitor the extension's behavior and check for any suspicious activities or performance issues.

- Consider exploring alternative solutions or extensions with more limited and specific permissions that align with their stated functionality.

- Report any concerns or issues to the extension developer or the appropriate authorities if you suspect malicious behavior.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: proxy

This extension has the proxy permission. Can control proxy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

tabs
activeTab
idle
background
webNavigation
webRequest
webRequestBlocking
proxy
cookies
storage
contextMenus
unlimitedStorage
<all_urls>

Optional Permissions:

bookmarks
notifications

Content Security Policy:

script-src 'self' https://*.firebaseio.com https://ssl.google-analytics.com https://apis.google.com https://www.google-analytics.com https://www.googleapis.com; object-src 'self' https://*.firebaseio.com https://www.googleapis.com

Embedded URLs (793 total):

http://www.apache.org/licenses/LICENSE-2.0	https://stackoverflow.com/a/2117523
https://www.google.com/recaptcha/api.js	https://content-firebaseappcheck.googleapis.com/v1beta
https://webpack.js.org/configuration/resolve/#resolvemainfields	https://github.com/rollup/@rollup/plugin-node-resolve
http://javascript.nwbox.com/IEContentLoaded/	http://hg.secondlife.com/llsd/src/tip/js/typedarray.js
https://console.firebase.google.com/.	https://app.asana.com/0/search/8688598998380/8237608042508
https://app.asana.com/0/58926111402292/68021340250410	https://forum.ionicframework.com/t/firebase-connection-is-lost-and-never-come-back/43810
http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.46.1458	https://firebase.google.com/docs/database/web/lists-of-data#data-order
https://firebase.google.com/docs/database/web/lists-of-data#orderbykey	https://firebase.google.com/docs/database/web/offline-capabilities
https://firebase.google.com/docs/database/web/lists-of-data#sorting_and_filtering_data	https://firebase.google.com/docs/database/web/lists-of-data#append_to_a_list_of_data
https://firebase.googleblog.com/2015/09/introducing-multi-location-updates-and_86.html	https://firebase.google.com/docs/database/web/lists-of-data#filtering_data
https://firebase.google.com/docs/database/security/indexing-data	https://firebase.google.com/docs/database/web/lists-of-data#sort_data
https://github.com/firebase/firebase-admin-node	https://github.com/rollup/rollup/issues/1691
https://snyk.io/vuln/SNYK-JS-LODASH-450202	https://securetoken.google.com/
https://github.com/iliakan/detect-node/	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error#Custom_Error_Types
https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work	http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.
https://bugs.webkit.org/show_bug.cgi?id=109036	http://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3
https://github.com/google/closure-library/blob/master/closure/goog/math/exponentialbackoff.js.	https://github.com/getsentry/sentry-javascript/issues/3344
https://github.com/bugsnag/bugsnag-js/issues/469	https://github.com/getsentry/sentry-javascript/issues/838
http://stackoverflow.com/questions/105034/how-to-create-a-guid-uuid-in-javascript/2117523#2117523	https://tools.ietf.org/html/rfc3986#appendix-B
https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string	https://github.com/getsentry/sentry-javascript/issues/2043
https://github.com/getsentry/sentry/blob/master/src/sentry/lang/javascript/processor.py#L67	https://caniuse.com/#feat=referrer-policy
https://github.com/getsentry/raven-js/issues/1233	https://github.com/angular/angular.js/pull/13945/files
https://github.com/getsentry/sentry-javascript/issues/2590.	https://mathiasbynens.be/notes/javascript-encoding
https://tools.ietf.org/html/rfc3492#section-3.4	https://url.spec.whatwg.org/#default-port
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	https://github.com/tc39/proposal-observable
https://firebase.google.com/pricing/.	https://cloud.google.com/storage/docs/exponential-backoff
https://sessionbox.firebaseio.com	https://4af856d0eff3424099668ca0e14a8461@sentry.io/107368
https://reseller.api.foxyproxy.com	https://sessionbox.io
https://sessionbox.io/_jump	https://sessionbox-directory.herokuapp.com/api
https://api.sessionbox.io/	https://backend-services.sessionbox.io/
https://statistics-service.sessionbox.io	https://sessionbox.io/plans
https://sessionbox.io/help	https://chrome.google.com/webstore/detail/sessionbox-beta/megbklhjamjbcafknkgmokldgolkdfig/reviews?hl=en
https://twitter.com/session_box	https://www.facebook.com/SessionBoxTeam/
https://sessionbox.io/account/billing	https://sessionbox.io/account-billing-info
https://sessionbox.io/account/lost-authenticator	https://sessionbox.io/account/setup-two-factor
https://sessionbox.io/account/security	https://sessionbox.io/account/proxies
https://one.sessionbox.io/download	https://staging-identitytoolkit.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/
https://staging-securetoken.sandbox.googleapis.com/v1/token	https://staging-identitytoolkit.sandbox.googleapis.com/v2/
https://www.googleapis.com/identitytoolkit/v3/relyingparty/	https://securetoken.googleapis.com/v1/token
https://identitytoolkit.googleapis.com/v2/	https://staging-www.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/

Page 1 of 10

Raw Manifest

{
  "name": "SessionBox - Multi login to any website",
  "icons": {
    "16": "assets/Icon16.png",
    "48": "assets/Icon48.png",
    "128": "assets/Icon128.png"
  },
  "version": "1.8.9",
  "commands": {
    "new_session": {
      "description": "__MSG_NEW_SESSION_COMMAND__",
      "suggested_key": {
        "default": "Ctrl+Shift+X"
      }
    },
    "new_temporary_session": {
      "description": "__MSG_NEW_TEMPORARY_SESSION_COMMAND__",
      "suggested_key": {
        "default": "Ctrl+Shift+A"
      }
    },
    "bulk_temporary_session": {
      "description": "__MSG_OPEN_BULK_TEMPORARY__",
      "suggested_key": {
        "default": "Ctrl+Shift+D"
      }
    },
    "_execute_browser_action": {
      "suggested_key": {
        "default": "Ctrl+Shift+S"
      }
    }
  },
  "incognito": "spanning",
  "background": {
    "scripts": [
      "publicsuffixlist.js",
      "forge.min.js",
      "CookieJar.js",
      "background.js"
    ]
  },
  "short_name": "SessionBox",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_PROMO_SHORT__",
  "permissions": [
    "tabs",
    "activeTab",
    "idle",
    "background",
    "webNavigation",
    "webRequest",
    "webRequestBlocking",
    "proxy",
    "cookies",
    "storage",
    "contextMenus",
    "unlimitedStorage",
    "<all_urls>"
  ],
  "browser_action": {
    "default_icon": {
      "19": "assets/Icon19.png",
      "38": "assets/Icon38.png"
    },
    "default_popup": "views.html",
    "default_title": "SessionBox"
  },
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "website-connector.content-script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://sessionbox.io/*"
      ]
    },
    {
      "js": [
        "virtual-session.content-script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "updater.content-script.js",
        "overlay.content-script.js",
        "incognito.content-script.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "manifest_version": 2,
  "optional_permissions": [
    "bookmarks",
    "notifications"
  ],
  "minimum_chrome_version": "45",
  "content_security_policy": "script-src 'self' https://*.firebaseio.com https://ssl.google-analytics.com https://apis.google.com https://www.google-analytics.com https://www.googleapis.com; object-src 'self' https://*.firebaseio.com https://www.googleapis.com",
  "web_accessible_resources": [
    "assets/VirtualSessionHelper.js",
    "assets/C6Fix.js",
    "assets/Icons/box.svg",
    "views.html",
    "view.css",
    "views.js",
    "Views/NewSessionTutorial.css",
    "assets/actions/*",
    "assets/Fonts/*"
  ]
}

by ✦ Astarte

SessionBox - Multi login to any website

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Content Security Policy:

Embedded URLs (793 total):

Raw Manifest

Detections

Manifest Findings