[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Bitwarden Password Manager

Version 2026.3.0 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: Bitwarden Inc.

Rating: 4.4 ★ (7.6K ratings)

Users: 6,000,000

Context-Aware Verdict

LOW

Overall Risk

Trust Factors:

Bitwarden is a well-established, reputable company in the cybersecurity space with a strong track record for password management. The extension has an impressive 6 million users and a solid 4.4-star rating from over 7,600 reviews, indicating widespread user satisfaction and trust. Bitwarden operates as an open-source project, allowing for community scrutiny of their code, which adds significant transparency and credibility.

Concerns:

While the security analysis flags numerous high-risk permissions, these are actually necessary and appropriate for a password manager's core functionality. The clipboardRead/Write permissions enable secure password copying, webRequest/webNavigation permissions allow for autofill detection, and broad host permissions are required to work across all websites where users have accounts. The WebAssembly execution capability is likely used for cryptographic operations. However, users should be aware that these permissions do create a powerful extension with significant access to browsing data.

Recommendations:

This extension is safe to use in your main browser profile given Bitwarden's reputation and the legitimate need for these permissions in password management. Ensure you download only from the official Chrome Web Store and keep the extension updated. Consider enabling two-factor authentication on your Bitwarden account for additional security. The high permission requirements are justified by the extension's purpose and the company's trustworthy track record.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

activeTab
alarms
clipboardRead
clipboardWrite
contextMenus
idle
offscreen
scripting
storage
tabs
unlimitedStorage
webNavigation
webRequest
webRequestAuthProvider
notifications

Optional Permissions:

nativeMessaging
privacy

Host Permissions:

https://*/*
http://*/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'
sandbox: sandbox allow-scripts; script-src 'self'

Embedded URLs (1086 total):

https://clients2.google.com/service/update2/crx	https://bitwarden.com
https://github.com/mholt/PapaParse	http://stuartk.com/jszip
https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.	https://github.com/nodeca/pako/blob/main/LICENSE
https://feross.org	http://tartarus.org/~martin/PorterStemmer/js.txt
https://feross.org/opensource	http://lunrjs.com
https://tc39.es/ecma262/#sec-object.defineproperties	https://tc39.es/ecma262/#sec-math.trunc
https://tc39.es/ecma262/#sec-toprimitive	https://github.com/tc39/proposal-shadowrealm/pull/384#issuecomment-1364264229
https://github.com/lodash/lodash/blob/4.17.15/dist/lodash.js#L6735-L6744	https://github.com/dchest/tweetnacl-js
https://tools.ietf.org/html/rfc8032	https://github.com/digitalbazaar/forge/blob/master/lib/asn1.js#L542
https://tools.ietf.org/html/rfc8410#section-10.3	https://bugzilla.mozilla.org/show_bug.cgi?id=695438
https://github.com/feross/buffer/pull/148	https://github.com/feross/buffer/issues/154
http://stackoverflow.com/a/22747272/680742	https://github.com/feross/buffer/issues/166
https://github.com/feross/buffer/issues/219	https://github.com/kjur/jsjws/blob/master/rsa.js:
http://webrsa.cvs.sourceforge.net/viewvc/webrsa/Client/RSAES-OAEP.js?content-type=text%2Fplain:	http://www.rsa.com/rsalabs/node.asp?id=2125
http://evanjones.ca/	https://github.com/tc39/proposal-arraybuffer-base64
https://tc39.es/ecma262/#sec-array.prototype.includes	https://tc39.es/ecma262/#sec-array.prototype.indexof
https://github.com/tc39/proposal-explicit-resource-management	https://github.com/nodejs/node/issues/48699
https://tc39.es/ecma262/#sec-object.getprototypeof	http://tartarus.org/~martin
https://github.com/olivernn/lunr.js/issues/279	https://lunrjs.com/guides/searching.html#scoring
https://github.com/umdjs/umd/blob/master/returnExports.js	https://tc39.es/ecma262/#sec-%iteratorprototype%-object
https://tc39.es/ecma262/#sec-%iteratorprototype%-@@iterator	https://github.com/cryptocoinjs/base-x
https://tc39.es/ecma262/#sec-ordinarytoprimitive	https://tc39.es/ecma262/#sec-topropertykey
https://github.com/tc39/proposal-async-explicit-resource-management	https://github.com/tc39/proposal-explicit-resource-management/issues/256
https://stuk.github.io/jszip/documentation/howto/read_zip.html	https://github.com/oven-sh/bun/issues/9282
https://github.com/oven-sh/bun/issues/9283	http://www.tero.co.uk/des/
http://www.netdealing.com	https://github.com/zloirock/core-js/blob/v3.48.0/LICENSE
https://github.com/zloirock/core-js	https://tc39.es/proposal-explicit-resource-management/#sec-getdisposemethod
https://tc39.es/proposal-explicit-resource-management/#sec-createdisposableresource	https://tc39.es/proposal-explicit-resource-management/#sec-adddisposableresource
https://github.com/ljharb/object.assign/issues/17	https://github.com/WebReflection/get-own-property-symbols/issues/4
https://tc39.es/ecma262/#sec-getmethod	https://bugs.chromium.org/p/v8/issues/detail?id=3334
ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-12/pkcs-12-tc1.pdf	https://tc39.es/ecma262/#sec-toobject
http://www.openssl.org	http://www.openssl.org/docs/crypto/EVP_BytesToKey.html
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	https://tc39.es/ecma262/#sec-iscallable
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot-aec	https://tc39.es/ecma262/#sec-object.prototype.propertyisenumerable
https://tc39.es/ecma262/#sec-hasownproperty	https://tc39.es/ecma262/#sec-object.defineproperty
http://www.ietf.org/rfc/rfc2315.txt	https://mathiasbynens.be/notes/javascript-encoding
https://tools.ietf.org/html/rfc3492#section-3.4	https://tc39.es/ecma262/#sec-object.setprototypeof
https://datatracker.ietf.org/doc/html/rfc7468#section-7	https://code.google.com/p/chromium/issues/detail?id=25916
http://foo.com	http://www.example.com
https://tc39.es/ecma262/#sec-object.getownpropertynames	https://github.com/zloirock/core-js/issues/1128

Page 1 of 14

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "16": "images/icon16.png",
    "32": "images/icon32.png",
    "48": "images/icon48.png",
    "96": "images/icon96.png",
    "128": "images/icon128.png"
  },
  "action": {
    "default_icon": {
      "19": "images/icon19.png",
      "38": "images/icon38.png"
    },
    "default_popup": "popup/index.html",
    "default_title": "Bitwarden"
  },
  "author": "Bitwarden Inc.",
  "sandbox": {
    "pages": [
      "overlay/menu-button.html",
      "overlay/menu-list.html"
    ]
  },
  "storage": {
    "managed_schema": "managed_schema.json"
  },
  "version": "2026.3.0",
  "commands": {
    "lock_vault": {
      "description": "__MSG_commandLockVaultDesc__"
    },
    "autofill_card": {
      "description": "__MSG_commandAutofillCardDesc__"
    },
    "autofill_login": {
      "description": "__MSG_commandAutofillLoginDesc__",
      "suggested_key": {
        "default": "Ctrl+Shift+L"
      }
    },
    "_execute_action": {
      "description": "__MSG_commandOpenPopup__",
      "suggested_key": {
        "linux": "Ctrl+Shift+U",
        "default": "Ctrl+Shift+Y"
      }
    },
    "autofill_identity": {
      "description": "__MSG_commandAutofillIdentityDesc__"
    },
    "generate_password": {
      "description": "__MSG_commandGeneratePasswordDesc__",
      "suggested_key": {
        "default": "Ctrl+Shift+9"
      }
    }
  },
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "Bitwarden",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extDesc__",
  "permissions": [
    "activeTab",
    "alarms",
    "clipboardRead",
    "clipboardWrite",
    "contextMenus",
    "idle",
    "offscreen",
    "scripting",
    "storage",
    "tabs",
    "unlimitedStorage",
    "webNavigation",
    "webRequest",
    "webRequestAuthProvider",
    "notifications"
  ],
  "homepage_url": "https://bitwarden.com",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content/content-message-handler.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*",
        "file:///*"
      ],
      "all_frames": false,
      "exclude_matches": [
        "*://*/*.xml*",
        "file:///*.xml*"
      ]
    },
    {
      "js": [
        "content/trigger-autofill-script-injection.js"
      ],
      "css": [
        "content/autofill.css"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*",
        "file:///*"
      ],
      "all_frames": true,
      "exclude_matches": [
        "*://*/*.xml*",
        "file:///*.xml*"
      ]
    }
  ],
  "host_permissions": [
    "https://*/*",
    "http://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "nativeMessaging",
    "privacy"
  ],
  "minimum_chrome_version": "102.0",
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; script-src 'self'",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "content/fido2-page-script.js",
        "notification/bar.html",
        "images/icon38.png",
        "images/icon38_locked.png",
        "overlay/menu-button.html",
        "overlay/menu-list.html",
        "overlay/menu.html",
        "popup/fonts/*"
      ],
      "use_dynamic_url": true
    }
  ]
}

by ✦ Astarte

Bitwarden Password Manager

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (1086 total):

Raw Manifest

Detections

Manifest Findings