[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

pCloud Save

Version 2.0.2 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Rating: 3.0 ★ (141 ratings)

Users: 20,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension is developed by pCloud, a legitimate cloud storage company with an established reputation. However, the moderate user base of 20,000 users and concerning 3.0 rating from 141 reviews suggest potential issues with functionality or user experience. The lack of recent update information raises questions about ongoing maintenance and security patches.

Concerns:

The extension requests excessive permissions that appear unnecessary for basic cloud saving functionality. The combination of tabs permission with broad host permissions (<all_urls>) creates significant privacy risks, allowing the extension to monitor and access all browsing activity across every website. The ability to inject content scripts into all websites is particularly concerning, as this could enable data harvesting, credential theft, or website manipulation. The declarativeNetRequest permission adds another layer of network-level access that seems disproportionate for a file saving tool.

Recommendations:

Consider running this extension in a separate Chrome profile to isolate it from your primary browsing activities and sensitive accounts. Before installation, verify that you actually need the advanced features that might justify these broad permissions. Monitor the extension's behavior closely after installation, particularly any unexpected network requests or changes to website functionality. Consider alternative cloud storage extensions with more limited permission sets if you only need basic file saving capabilities. Regularly review and audit the extension's permissions through Chrome's extension management interface.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://www.google-analytics.com/. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
activeTab
contextMenus
notifications
storage
windows
scripting
declarativeNetRequest

Host Permissions:

<all_urls>
http://*/*
https://*/*
https://www.google-analytics.com/

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'; media-src 'self'; script-src-elem 'self' https://my.pcloud.com/dist/ https://appleid.cdn-apple.com https://cdn.safecharge.com

Embedded URLs (148 total):

https://www.pcloud.com/?ref=1732	https://www.pcloud.com/cloud-storage-pricing-plans.html?ref=1732
https://www.pcloud.com/extension.html?ref=1732	https://my.pcloud.com/fbpoll.html
https://my.pcloud.com/glpoll.html	https://my.pcloud.com/applesignin
http://www.facebook.com/sharer/sharer.php?u=	http://twitter.com/share?url=
https://my.pcloud.com/#page=filemanager&folder=	https://my.pcloud.com/
https://www.pcloud.com/extension-survey.html	http://www.apache.org/licenses/LICENSE-2.0
https://webpack.js.org/configuration/resolve/#resolvemainfields	https://github.com/rollup/rollup-plugin-node-resolve
https://github.com/rollup/rollup/issues/1691	https://github.com/iliakan/detect-node/
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error#Custom_Error_Types	https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.	https://bugs.webkit.org/show_bug.cgi?id=109036
http://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3	https://github.com/google/closure-library/blob/master/closure/goog/math/exponentialbackoff.js.
https://github.com/zloirock/core-js/issues/86#issuecomment-115759028	http://jsperf.lnkit.com/fast-apply/5
https://github.com/zloirock/core-js/issues/339	https://bugs.chromium.org/p/chromium/issues/detail?id=830565
https://github.com/zloirock/core-js/issues/173	https://code.google.com/p/v8/issues/detail?id=687
https://bugs.chromium.org/p/v8/issues/detail?id=3443	https://github.com/tc39/proposal-object-getownpropertydescriptors
https://github.com/tc39/proposal-promise-finally	https://github.com/tc39/proposal-promise-try
http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring	http://ecma-international.org/ecma-262/7.0/#sec-patterns
https://lodash.com/	https://bugs.chromium.org/p/v8/issues/detail?id=4118
https://bugs.chromium.org/p/v8/issues/detail?id=3056	http://fb.me/use-check-prop-types
http://fb.me/prop-types-in-prod	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
https://facebook.github.io/react/docs/shallow-compare.html	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	https://fb.me/react-polyfills
https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en	https://itunes.apple.com/bg/app/google-authenticator/id388497605?mt=8
https://play.google.com/store/apps/details?id=com.pcloud.pcloud&referrer=utm_source?website&utm_medium?click	https://itunes.apple.com/us/app/pcloud/id692002098
https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js	https://github.com/facebook/regenerator/blob/main/LICENSE
https://my.pcloud.com/cookie?	https://u.pcloud.link/cookie?
https://my.pcloud.com/checkcookie?names=	https://e.pcloud.link/checkcookie?names=
https://github.com/tc39/proposal-observable	https://redux.js.org/tutorials/fundamentals/part-4-store#writing-custom-middleware
https://apipass.pcloud.com/	https://pass.pcloud.com
https://github.com/styled-components/styled-components/blob/main/packages/styled-components/src/utils/errors.md#	https://github.com/h5bp/html5-boilerplate/blob/9a176f57af1cfe8ec70300da4621fb9b07e5fa31/src/css/main.css#L121
https://en.wikipedia.org/wiki/HSL_and_HSV	https://github.com/gcanti/flow-static-land/blob/master/src/Fun.js
http://sass-lang.com/documentation/Sass/Script/Functions.html#mix-instance_method	https://www.w3.org/TR/WCAG20-TECHS/G18.html
http://mdn.io/animation	https://chrome.google.com/webstore/detail/pcloud-save/npamdkabjncnnoaofdjcaipmnccofeem?authuser=1
https://addons.mozilla.org/en-US/firefox/addon/pcloud-save/	https://chrome.google.com/webstore/detail/pcloud-save/npamdkabjncnnoaofdjcaipmnccofeem
https://microsoftedge.microsoft.com/addons/detail/pcloud-save/fddpghdlmniinppliebghcdamdiainge	https://chrome.google.com/webstore/detail/pcloud-pass-password-mana/hldllnfgjbablcfcdcjldbbfopmohnda
https://addons.mozilla.org/en-US/firefox/addon/pcloud-pass-password-manager/	https://microsoftedge.microsoft.com/addons/detail/pcloud-pass-password-ma/ebiiomgikeochbjcbafgeapfmcfgapap
https://apps.apple.com/us/app/pcloud-pass-password-manager/id1607974524	https://apps.apple.com/app/id/1607974524
https://play.google.com/store/apps/details?id=com.pcloud.pass	https://fb.me/react-async-component-lifecycle-hooks

Page 1 of 2

Raw Manifest

{
  "name": "pCloud Save",
  "icons": {
    "16": "img/context/icon-bitty.png",
    "48": "img/context/icon-small.png",
    "128": "img/context/icon-large.png"
  },
  "action": {
    "default_icon": {
      "16": "img/icon_off.png",
      "32": "img/icon_off.png",
      "64": "img/icon_off.png"
    },
    "default_popup": "popup.html"
  },
  "author": "pCloud AG - www.pcloud.com",
  "version": "2.0.2",
  "background": {
    "service_worker": "js/background.js"
  },
  "options_ui": {
    "page": "options.html"
  },
  "short_name": "pCloud",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Save your favorite web images, videos, text and more to pCloud - up to 10 GB free storage.",
  "permissions": [
    "tabs",
    "activeTab",
    "contextMenus",
    "notifications",
    "storage",
    "windows",
    "scripting",
    "declarativeNetRequest"
  ],
  "options_page": "options.html",
  "content_scripts": [
    {
      "js": [
        "js/jquery-3.2.1.min.js"
      ],
      "css": [
        "css/content-style.css"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ],
      "all_frames": false,
      "match_about_blank": true
    },
    {
      "js": [
        "js/content-script.js"
      ],
      "css": [
        "css/content-style.css"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ],
      "all_frames": false,
      "match_about_blank": true
    }
  ],
  "host_permissions": [
    "<all_urls>",
    "http://*/*",
    "https://*/*",
    "https://www.google-analytics.com/"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'; media-src 'self'; script-src-elem 'self' https://my.pcloud.com/dist/ https://appleid.cdn-apple.com https://cdn.safecharge.com"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "partial/hint-pdf.html",
        "img/partial/icon_on_20x20.png",
        "img/partial/icon_on_20x20@2x.png",
        "img/partial/slim_close.png",
        "img/partial/slim_close@2x.png",
        "img/partial/lightning.png",
        "img/partial/lightning@2x.png"
      ],
      "use_dynamic_url": true
    }
  ]
}

by ✦ Astarte

pCloud Save

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (148 total):

Raw Manifest

Detections

Manifest Findings