[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Global Privacy Control (GPC) Inspector

Version 0.1.4 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: protegis.io

Rating: 4.4 ★ (9 ratings)

Users: 6,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a moderate user base of 6,000 users with a good rating of 4.4/5, though based on only 9 reviews which limits confidence. The developer protegis.io appears to be focused on privacy tools, which aligns with the extension's stated purpose of inspecting Global Privacy Control signals. However, the limited review count and relatively new status (version 0.1.4) suggest this is still an emerging tool.

Concerns: The extension requests extremely broad permissions that seem excessive for a GPC inspection tool. The webRequest permission allows intercepting and modifying all web traffic, while tabs permission enables monitoring all browser activity. The <all_urls> host permission grants access to every website you visit. For a tool that should primarily inspect GPC headers, these permissions appear unnecessarily invasive and create significant privacy risks. The declarativeNetRequest permissions could also be used to block or modify network requests in ways beyond the stated functionality.

Recommendations: Given the high-risk permission set, consider running this extension in a separate Chrome profile dedicated to privacy testing if you need its functionality. Monitor the extension's network activity using browser developer tools to ensure it's only performing GPC inspection. Consider alternative GPC testing tools with more limited permissions, or use browser developer tools manually to inspect GPC headers. Regularly review what data the extension might be storing locally through the storage permission.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
declarativeNetRequest
declarativeNetRequestFeedback
tabs
scripting
webRequest

Host Permissions:

<all_urls>

Embedded URLs (70 total):

https://stackoverflow.com/questions/10994324/chrome-extension-content-script-re-injection-after-upgrade-or-install/11598753#11598753	https://securepubads.g.doubleclick.net
https://stats.g.doubleclick.net	https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
https://protegis.io	https://twitter.com/protegis_io
https://clients2.google.com/service/update2/crx	https://stackoverflow.com/questions/23202136/changing-navigator-useragent-using-chrome-extension
https://stackoverflow.com/questions/9515704/access-variables-and-functions-defined-in-page-context-using-a-content-script/9517879#9517879	https://getbootstrap.com/
https://github.com/twbs/bootstrap/graphs/contributors	https://github.com/twbs/bootstrap/blob/main/LICENSE
https://popper.js.org	http://www.w3.org/2000/svg
https://github.com/sass/sass/issues/2383#issuecomment-336349172	https://github.com/twbs/rfs/blob/main/LICENSE
https://github.com/twbs/rfs/issues/14	https://www.w3.org/TR/mediaqueries-4/#mq-min-max
https://bugs.webkit.org/show_bug.cgi?id=178261	https://github.com/react-bootstrap/react-bootstrap/issues/6039
https://github.com/philipwalton/flexbugs#flexbug-4	https://github.com/necolas/normalize.css
https://github.com/twbs/bootstrap/issues/19402	https://github.com/twbs/bootstrap/issues/24093
https://github.com/twbs/bootstrap/pull/30562	https://github.com/twbs/bootstrap/issues/24990
https://stackoverflow.com/a/54997118	https://github.com/twbs/bootstrap/issues/12359
https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements	https://github.com/twbs/bootstrap/issues/29712
https://github.com/twbs/bootstrap/issues/18842	https://github.com/twbs/bootstrap/issues/11586.
https://rtlstyling.com/posts/rtl-styling#form-inputs	https://rtlcss.com/learn/usage-guide/control-directives/#raw
https://github.com/twbs/bootstrap/issues/18178	https://github.com/twbs/bootstrap/issues/23307
https://bugs.webkit.org/show_bug.cgi?id=198959	https://github.com/twbs/bootstrap/pull/11526.
https://github.com/twbs/bootstrap/issues/11655.	https://github.com/twbs/bootstrap/pull/29124
https://primer.github.io/.	https://github.com/twbs/bootstrap/issues/32636
https://github.com/twbs/bootstrap/issues/28247	https://stackoverflow.com/questions/36247140/why-dont-flex-items-shrink-past-content-size
https://github.com/sass/sass/issues/1873#issuecomment-152293725	https://github.com/twbs/bootstrap/pull/22740#issuecomment-305868106
https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile	https://github.com/twbs/bootstrap/pull/10951.
https://bugs.webkit.org/show_bug.cgi?id=158342	https://github.com/twbs/bootstrap/issues/17695
https://github.com/twbs/bootstrap/issues/24800	https://github.com/sass/node-sass/issues/2251
https://www.a11yproject.com/posts/2013-01-11-how-to-hide-content/	https://kittygiraudel.com/2016/10/13/css-hide-and-seek/
https://github.com/twbs/bootstrap/issues/25686	https://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1
https://www.w3.org/TR/WCAG20/#visual-audio-contrast-contrast	https://goo.gl/pxwQGp
https://github.com/twbs/bootstrap/issues/32273	https://www.charistheo.io/blog/2021/02/restart-a-css-animation-with-javascript/#restarting-a-css-animation
https://getbootstrap.com/docs/5.2/forms/input-group/	https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
https://developer.mozilla.org/en-US/docs/Web/API/Window/innerWidth#usage_notes	https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts
https://github.com/popperjs/popper-core/issues/1223	https://github.com/popperjs/popper-core/issues/837
https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block	https://github.com/facebook/flow/issues/1414
https://github.com/popperjs/popper-core/issues/1078	https://stackoverflow.com/questions/49875255

Raw Manifest

{
  "name": "Global Privacy Control (GPC) Inspector",
  "icons": {
    "16": "images/shield-16.png",
    "32": "images/shield-32.png",
    "48": "images/shield-48.png",
    "128": "images/shield-128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/shield-16.png",
      "32": "images/shield-32.png",
      "48": "images/shield-48.png",
      "128": "images/shield-128.png"
    },
    "default_popup": "popup.html",
    "default_title": "Global Privacy Control Inspector"
  },
  "version": "0.1.4",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "This GPC Chrome Extension enables the Global Privacy Control opt-out signal and evaluates how websites respond to the setting",
  "permissions": [
    "storage",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "tabs",
    "scripting",
    "webRequest"
  ],
  "content_scripts": [
    {
      "js": [
        "contentScript.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_origin_as_fallback": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "inject.js"
      ]
    }
  ]
}

by ✦ Astarte

Global Privacy Control (GPC) Inspector

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (70 total):

Raw Manifest

Detections

Manifest Findings