[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

VisaSlots.info

Version 0.7.0 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: visaslots.info

Rating: 4.3 ★ (13 ratings)

Users: 8,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a moderate user base of 8,000 users with a solid 4.3-star rating, though based on only 13 reviews which is relatively few for the user count. The developer domain matches the extension name (visaslots.info), suggesting legitimate ownership. The extension appears to serve a specific purpose related to US visa appointment scheduling, which is a legitimate need for many users.

Concerns:

The primary concern is the broad host permissions that extend beyond the stated purpose. While the extension legitimately needs access to usvisascheduling.com for visa appointment functionality, the content script injection on visaslots.info suggests potential data collection or tracking capabilities. The combination of storage permissions with broad access could allow the extension to collect and store sensitive visa application data or personal information. The scripting permission combined with activeTab access provides significant control over web pages when the extension is activated.

Recommendations:

Consider running this extension in a separate Chrome profile dedicated to visa-related activities to limit exposure of other browsing data. Monitor the extension's behavior on non-visa websites and disable it when not actively scheduling appointments. Review what data the extension stores locally through Chrome's developer tools. Given the sensitive nature of visa applications, ensure you trust the developer before proceeding, and consider alternative methods for visa appointment scheduling if available.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "VisaSlots.info",
  "icons": {
    "128": "images/icon-128.png"
  },
  "action": {
    "default_popup": "popup/index.html",
    "default_title": "VisaSlots.info"
  },
  "version": "0.7.0",
  "background": {
    "service_worker": "service-worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Crowdsourced Visa Slot Availability",
  "permissions": [
    "storage",
    "scripting",
    "activeTab"
  ],
  "content_scripts": [
    {
      "js": [
        "scripts/history.js"
      ],
      "matches": [
        "https://visaslots.info/*"
      ]
    },
    {
      "js": [
        "scripts/content.js"
      ],
      "matches": [
        "https://www.usvisascheduling.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://www.usvisascheduling.com/*"
  ],
  "manifest_version": 3,
  "optional_host_permissions": [
    "https://atlasauth.b2clogin.com/*"
  ]
}

by ✦ Astarte

VisaSlots.info

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (7 total):

Raw Manifest

Detections

Manifest Findings

https://visaslots.info	https://visaslots.info/contribute
https://clients2.google.com/service/update2/crx	https://visaslots.info/
https://www.usvisascheduling.com/	https://atlasauth.b2clogin.com/
https://stackoverflow.com/a/13768794