[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

KOAL Sign Extension

Version 3.0.21 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Rating: 2.9 ★

Users: 3

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: This extension has extremely limited adoption with only 3 users and a concerning 2.9-star rating, suggesting user dissatisfaction or potential issues. The lack of visible developer information and company details raises transparency concerns. The extension appears to be related to digital signing functionality based on its name.

Concerns: The extension requests the tabs permission which allows broad access to browser tab information and manipulation capabilities - this is excessive for what appears to be a signing tool that should only need to interact with specific documents or forms. The nativeMessaging permission indicates it communicates with external applications on your computer, which could be a security vector if the native component is compromised. Content scripts run on all HTTP and HTTPS websites, giving the extension access to all web pages you visit, which seems unnecessary for a signing application that should only activate on specific sites or documents.

Recommendations: Given the low user base, poor rating, and broad permissions that don't align with the extension's apparent purpose, consider using established digital signing solutions instead. If you must use this extension, run it in a separate Chrome profile to isolate it from your main browsing activities. Monitor what native applications it attempts to communicate with and ensure they are legitimate. Consider whether the signing functionality could be achieved through more trusted alternatives or web-based solutions that don't require browser extensions.

Findings

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

Raw Manifest

{
  "name": "KOAL Sign Extension",
  "icons": {
    "16": "icon-16.png",
    "48": "icon-128.png",
    "128": "icon-128.png"
  },
  "action": {
    "default_icon": "icon-16.png"
  },
  "author": "KOAL",
  "version": "3.0.21",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "KOAL Sign Extension",
  "permissions": [
    "nativeMessaging",
    "tabs"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "http://*.example.com/*",
      "http://localhost/*",
      "http://*.srcb.com/*",
      "https://*.srcb.com/*"
    ]
  }
}

by ✦ Astarte

KOAL Sign Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (1 total):

Raw Manifest

Detections

Manifest Findings