[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

pCloud Save

Version 2.0.2 View in Chrome Web Store

Last scanned: about 11 hours ago

Extension Details

Rating: 3.0 ★ (141 ratings)

Users: 20,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 8 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://www.google-analytics.com/. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
activeTab
contextMenus
notifications
storage
windows
scripting
declarativeNetRequest

Host Permissions:

<all_urls>
http://*/*
https://*/*
https://www.google-analytics.com/

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'; media-src 'self'; script-src-elem 'self' https://my.pcloud.com/dist/ https://appleid.cdn-apple.com https://cdn.safecharge.com

Embedded URLs (148 total):

https://www.pcloud.com/?ref=1732	https://www.pcloud.com/cloud-storage-pricing-plans.html?ref=1732
https://www.pcloud.com/extension.html?ref=1732	https://my.pcloud.com/fbpoll.html
https://my.pcloud.com/glpoll.html	https://my.pcloud.com/applesignin
http://www.facebook.com/sharer/sharer.php?u=	http://twitter.com/share?url=
https://my.pcloud.com/#page=filemanager&folder=	https://my.pcloud.com/
https://www.pcloud.com/extension-survey.html	http://www.apache.org/licenses/LICENSE-2.0
https://webpack.js.org/configuration/resolve/#resolvemainfields	https://github.com/rollup/rollup-plugin-node-resolve
https://github.com/rollup/rollup/issues/1691	https://github.com/iliakan/detect-node/
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error#Custom_Error_Types	https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.	https://bugs.webkit.org/show_bug.cgi?id=109036
http://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3	https://github.com/google/closure-library/blob/master/closure/goog/math/exponentialbackoff.js.
https://github.com/zloirock/core-js/issues/86#issuecomment-115759028	http://jsperf.lnkit.com/fast-apply/5
https://github.com/zloirock/core-js/issues/339	https://bugs.chromium.org/p/chromium/issues/detail?id=830565
https://github.com/zloirock/core-js/issues/173	https://code.google.com/p/v8/issues/detail?id=687
https://bugs.chromium.org/p/v8/issues/detail?id=3443	https://github.com/tc39/proposal-object-getownpropertydescriptors
https://github.com/tc39/proposal-promise-finally	https://github.com/tc39/proposal-promise-try
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	http://ecma-international.org/ecma-262/7.0/#sec-patterns
https://lodash.com/	https://bugs.chromium.org/p/v8/issues/detail?id=4118
https://bugs.chromium.org/p/v8/issues/detail?id=3056	http://fb.me/use-check-prop-types
http://fb.me/prop-types-in-prod	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
https://facebook.github.io/react/docs/shallow-compare.html	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	https://fb.me/react-polyfills
https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en	https://itunes.apple.com/bg/app/google-authenticator/id388497605?mt=8
https://play.google.com/store/apps/details?id=com.pcloud.pcloud&referrer=utm_source?website&utm_medium?click	https://itunes.apple.com/us/app/pcloud/id692002098
https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js	https://github.com/facebook/regenerator/blob/main/LICENSE
https://my.pcloud.com/cookie?	https://u.pcloud.link/cookie?
https://my.pcloud.com/checkcookie?names=	https://e.pcloud.link/checkcookie?names=
https://github.com/tc39/proposal-observable	https://redux.js.org/tutorials/fundamentals/part-4-store#writing-custom-middleware
https://apipass.pcloud.com/	https://pass.pcloud.com
https://github.com/styled-components/styled-components/blob/main/packages/styled-components/src/utils/errors.md#	https://github.com/h5bp/html5-boilerplate/blob/9a176f57af1cfe8ec70300da4621fb9b07e5fa31/src/css/main.css#L121
https://en.wikipedia.org/wiki/HSL_and_HSV	https://github.com/gcanti/flow-static-land/blob/master/src/Fun.js
http://sass-lang.com/documentation/Sass/Script/Functions.html#mix-instance_method	https://www.w3.org/TR/WCAG20-TECHS/G18.html
http://mdn.io/animation	https://chrome.google.com/webstore/detail/pcloud-save/npamdkabjncnnoaofdjcaipmnccofeem?authuser=1
https://addons.mozilla.org/en-US/firefox/addon/pcloud-save/	https://chrome.google.com/webstore/detail/pcloud-save/npamdkabjncnnoaofdjcaipmnccofeem
https://microsoftedge.microsoft.com/addons/detail/pcloud-save/fddpghdlmniinppliebghcdamdiainge	https://chrome.google.com/webstore/detail/pcloud-pass-password-mana/hldllnfgjbablcfcdcjldbbfopmohnda
https://addons.mozilla.org/en-US/firefox/addon/pcloud-pass-password-manager/	https://microsoftedge.microsoft.com/addons/detail/pcloud-pass-password-ma/ebiiomgikeochbjcbafgeapfmcfgapap
https://apps.apple.com/us/app/pcloud-pass-password-manager/id1607974524	https://apps.apple.com/app/id/1607974524
https://play.google.com/store/apps/details?id=com.pcloud.pass	https://fb.me/react-async-component-lifecycle-hooks

Page 1 of 2

Raw Manifest

{
  "name": "pCloud Save",
  "icons": {
    "16": "img/context/icon-bitty.png",
    "48": "img/context/icon-small.png",
    "128": "img/context/icon-large.png"
  },
  "action": {
    "default_icon": {
      "16": "img/icon_off.png",
      "32": "img/icon_off.png",
      "64": "img/icon_off.png"
    },
    "default_popup": "popup.html"
  },
  "author": "pCloud AG - www.pcloud.com",
  "version": "2.0.2",
  "background": {
    "service_worker": "js/background.js"
  },
  "options_ui": {
    "page": "options.html"
  },
  "short_name": "pCloud",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Save your favorite web images, videos, text and more to pCloud - up to 10 GB free storage.",
  "permissions": [
    "tabs",
    "activeTab",
    "contextMenus",
    "notifications",
    "storage",
    "windows",
    "scripting",
    "declarativeNetRequest"
  ],
  "options_page": "options.html",
  "content_scripts": [
    {
      "js": [
        "js/jquery-3.2.1.min.js"
      ],
      "css": [
        "css/content-style.css"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ],
      "all_frames": false,
      "match_about_blank": true
    },
    {
      "js": [
        "js/content-script.js"
      ],
      "css": [
        "css/content-style.css"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ],
      "all_frames": false,
      "match_about_blank": true
    }
  ],
  "host_permissions": [
    "<all_urls>",
    "http://*/*",
    "https://*/*",
    "https://www.google-analytics.com/"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'; media-src 'self'; script-src-elem 'self' https://my.pcloud.com/dist/ https://appleid.cdn-apple.com https://cdn.safecharge.com"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "partial/hint-pdf.html",
        "img/partial/icon_on_20x20.png",
        "img/partial/icon_on_20x20@2x.png",
        "img/partial/slim_close.png",
        "img/partial/slim_close@2x.png",
        "img/partial/lightning.png",
        "img/partial/lightning@2x.png"
      ],
      "use_dynamic_url": true
    }
  ]
}

by ✦ Astarte

pCloud Save

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (148 total):

Raw Manifest

Detections

Manifest Findings