[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

TextExpander: Keyboard Shortcuts & Templates

Version 843.1 View in Chrome Web Store

Last scanned: about 1 hour ago

Extension Details

Developer: TextExpander, Inc.

Rating: 4.5 ★ (143 ratings)

Users: 100,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: TextExpander is a well-established productivity company with a legitimate business model focused on text expansion and automation. The extension has 100,000 users and a solid 4.5-star rating from 143 reviews, indicating general user satisfaction. The company has been in the text expansion market for years and has a reputation for providing useful productivity tools.

Concerns: While the extension's core functionality justifies many permissions, several raise significant privacy concerns. The combination of clipboard read/write access with broad host permissions creates potential for sensitive data exposure. The extension can access all websites and inject scripts universally, which exceeds what's typically needed for text expansion. The unsafe WebAssembly execution permission is particularly concerning as it could hide malicious code. Native messaging capability suggests communication with external applications, expanding the attack surface.

The broad content script injection across all URLs means this extension can potentially read everything you type, including passwords, personal information, and sensitive documents on any website you visit.

Recommendations: Given the legitimate use case but extensive permissions, consider running this extension in a dedicated Chrome profile for work-related activities only. Avoid using it while accessing sensitive sites like banking or personal accounts. Regularly review what data the extension has access to and consider whether the productivity benefits outweigh the privacy trade-offs. Monitor for any unusual behavior or unexpected clipboard modifications.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
clipboardRead
storage
scripting
nativeMessaging
contextMenus
notifications
offscreen
clipboardWrite

Optional Permissions:

downloads

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'
sandbox: sandbox allow-scripts allow-forms; script-src 'self' 'unsafe-inline' 'unsafe-eval'

Embedded URLs (83 total):

https://reactjs.org/docs/error-decoder.html?invariant=	https://reactjs.org/link/react-polyfills
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	http://bit.ly/2kdckMn
https://tinyurl.com/y2uuvskb	https://github.com/GoogleChrome/dialog-polyfill/#stacking-context
https://www.textexpander.com	https://github.com/emscripten-core/emscripten/wiki/Linking
https://emscripten.org/docs/porting/pthreads.html#blocking-on-the-main-browser-thread	https://npms.io/search?q=ponyfill.
http://www.w3.org/2000/xmlns/	http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
https://cdn.jsdelivr.net/npm/@xenova/transformers@	https://huggingface.co/
https://developer.mozilla.org/en-US/docs/Web/API/Cache	https://huggingface.co/docs/transformers/main/chat_templating
https://github.com/xenova/transformers.js/issues/new/choose.	https://gist.github.com/hollance/42e32852f24243b748ae6bc1f985b13a
https://huggingface.co/docs/transformers.js/guides/node-audio-processing.	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
http://www.example.com	https://f336efd6c374e3423ba78d42145ca6c8@o272301.ingest.us.sentry.io/4510025673015296
https://lodash.com/	https://openjsf.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
https://momentjs.com/timezone/docs/#/use-it/browser/	http://momentjs.com/timezone/docs/#/data-loading/.
https://status.textexpander.com/api/v2/status.json	https://cgi.textexpander.com/cgi-bin/redirect.pl
https://status.textexpander.com	https://socket.io/docs/v3/migrating-from-2-x-to-3-0/
https://cdn.growthbook.io	https://growthproxy-prod.tenet.textexpander.com
http://jquery.org/license	https://github.com/warpdesign/deferred-js
https://gomakethings.com/vanilla-javascript-version-of-jquery-extend/	http://fb.me/use-check-prop-types
https://bit.ly/3cXEKWf	https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability
https://redux.js.org/Errors?code=	https://analytics.textexpander.com/v1
https://cgi.textexpander.com/appcast/update.php	http://jedwatson.github.io/classnames
http://react-dnd.github.io/react-dnd/docs/api/drag-source-monitor	http://react-dnd.github.io/react-dnd/docs/api/drop-target-monitor
https://reactjs.org/docs/refs-and-the-dom.html#callback-refs	https://react-dnd.github.io/react-dnd/docs/api/use-drag
https://textexpander.com/learn/using/snippets/snippet-fill-ins?hilite=fill-in	https://textexpander.com/templates
https://opensource.org/licenses/MIT	https://lea.verou.me
https://feross.org	https://github.com/jonschlinkert/is-plain-object
https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md	https://github.com/zloirock/core-js/blob/v3.30.0/LICENSE
https://github.com/zloirock/core-js	http://git.io/h4lmVg
http://git.io/TrdQbw	https://github.com/globalizejs/globalize
https://jquery.org/license	https://clients2.google.com/service/update2/crx
https://api.textexpander.com/	https://app.textexpander.com/
https://api.textexpander.com/ssoChrome	https://go.textexpander.com/
https://cxwnqxa8ae.execute-api.eu-west-1.amazonaws.com/prod/aia-llm-faq-kraken-api-lambda-sen	https://textexpander.com/submit-an-idea
http://jsonformatter.curiousconcept.com/	http://shancarter.github.io/mr-data-converter/

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgcEdgMSA4KVURVidWlozuFZUUTRd4cHiVh9bJtjRA0Q0WE8evBDtbsyOhKEbHsutoeg4Z6G3DrqTj7PKOd+WCGBZK50xey+IT9ki1pJbRK9nlzOSSGFb58NVm1myShtaFsTG9KxDqD2IXw6SILppMgFc3V1VPTcu2DdoBopJ7B//My/B+3uXmFqARA2w1XsJ4kl7i9AH2MozWMD4r6jfkryuAWQ4u0VGkMNkvUiDrVwSNYeQm4gvN23T6srBqmWx6vz5CzP4CuYeyBV9rQKU+mxXEn8/LM7s3EHDpASre/BTvg5yURb83sOJOHxBweyHODb2Cm6pawn/0JbdUwLizQIDAQAB",
  "name": "__MSG_EXTENSION_NAME__",
  "icons": {
    "16": "icons/icon16.png",
    "19": "icons/icon19.png",
    "24": "icons/icon24.png",
    "32": "icons/icon32.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_icon": {
      "19": "icons/icon19.png",
      "24": "icons/icon24.png",
      "32": "icons/icon32.png",
      "38": "icons/icon38.png"
    },
    "default_title": "__MSG_BROWSER_ACTION_TITLE__"
  },
  "sandbox": {
    "pages": [
      "evalWorkerSandbox.html"
    ]
  },
  "version": "843.1",
  "commands": {
    "inline-search": {
      "description": "Search Snippets",
      "suggested_key": {
        "mac": "MacCtrl+Period",
        "default": "Ctrl+Period"
      }
    },
    "_execute_action": {
      "suggested_key": {
        "mac": "MacCtrl+Shift+Period",
        "default": "Ctrl+Shift+Period"
      }
    }
  },
  "background": {
    "service_worker": "service-worker.js"
  },
  "options_ui": {
    "page": "preference.html"
  },
  "short_name": "TextExpander",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_EXTENSION_DESCRIPTION__",
  "permissions": [
    "tabs",
    "clipboardRead",
    "storage",
    "scripting",
    "nativeMessaging",
    "contextMenus",
    "notifications",
    "offscreen",
    "clipboardWrite"
  ],
  "version_name": "8.4.3 (843.1)",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "extension.js"
      ],
      "css": [],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "visualIndicator.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "aiRecommendationsOverlay.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false,
      "match_about_blank": false
    },
    {
      "js": [
        "ssoLogin.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://api.textexpander.com/ssoChrome*"
      ]
    },
    {
      "js": [
        "goURL.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://go.textexpander.com/*"
      ]
    }
  ],
  "offline_enabled": true,
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "downloads"
  ],
  "externally_connectable": {
    "matches": [
      "https://api.textexpander.com/*",
      "https://app.textexpander.com/*"
    ]
  },
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts allow-forms; script-src 'self' 'unsafe-inline' 'unsafe-eval'",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "teModal.html",
        "teInlineSearch.html",
        "contentLoaded.js",
        "main_window.html",
        "visualIndicator.css",
        "aiRecommendationsOverlay.css"
      ]
    }
  ]
}

by ✦ Astarte

TextExpander: Keyboard Shortcuts & Templates

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (83 total):

Raw Manifest

Detections

Manifest Findings