[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Dadan - Screen Recording & Annotation Tool

Version 5.0.0 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Developer: dadan.io

Rating: 4.6 ★ (41 ratings)

Users: 4,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension has a decent rating of 4.6/5 from 41 reviews and serves 4,000 users, suggesting some level of user satisfaction. However, the relatively small user base and limited review count provide insufficient validation for such extensive permissions. The developer domain (dadan.io) appears to be purpose-built for this extension, but lacks established reputation or transparency about the company behind it.

Concerns: The extension requests extremely broad permissions that far exceed what's typically needed for screen recording and annotation. The combination of universal host permissions, content script injection across all websites, cookie access, and download capabilities creates a perfect storm for data theft. The unsafe WebAssembly execution policy is particularly concerning as it could hide malicious code. For a screen recording tool, permissions like cookie access and universal website access are completely unnecessary and represent significant overreach.

The critical risk rating is justified by the potential for this extension to monitor all browsing activity, steal credentials from any website, access sensitive cookies, and download files without user knowledge. The broad content script injection means it could modify banking sites, capture passwords, or inject malicious content.

Recommendations: Do not install this extension in your primary browser profile. If you must use it, create a completely separate Chrome profile with no saved passwords, logged-out of all accounts, and use it only for screen recording tasks on non-sensitive websites. Consider alternative screen recording tools with more appropriate permission models.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
cookies
offscreen
tabs
downloads
alarms

Host Permissions:

https://*/*
http://*/*
<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self';

Embedded URLs (28 total):

https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
https://app.dadan.io	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://app.dadan.io/video/embed/	https://tinyurl.com/y2uuvskb
http://bit.ly/2kdckMn	https://radix-ui.com/primitives/docs/components/
https://json-schema.org/draft/2020-12/schema	http://json-schema.org/draft-07/schema#
http://json-schema.org/draft-04/schema#	https://konvajs.org/docs/posts/Tainted_Canvas.html.
https://konvajs.github.io/docs/react/DOM_Portal.html	https://github.com/konvajs/react-konva/issues/256
https://github.com/konvajs/react-konva/issues/194	https://kb.dadan.io/
https://dadan.io/pricing	https://chrome.google.com/webstore/detail/oagkbgolfdnkknkjomnggnhmnlfmgdod
https://app.dadan.io/onboarding/extension	https://ieneyvu1fwj.typeform.com/to/bQ5I9foh
https://app.dadan.io/playground	https://clients2.google.com/service/update2/crx
https://github.com/ForbesLindesay/umd/blob/master/template.js	https://emscripten.org/docs/getting_started/FAQ.html#how-do-i-run-a-local-webserver-for-testing-why-does-my-program-stall-in-downloading-or-preparing

Raw Manifest

{
  "name": "Dadan - Screen Recording & Annotation Tool",
  "icons": {
    "16": "icon16.plasmo.f55db0df.png",
    "32": "icon32.plasmo.a826ae6e.png",
    "48": "icon48.plasmo.775d15c4.png",
    "64": "icon64.plasmo.abe633b3.png",
    "128": "icon128.plasmo.5c8d909e.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.plasmo.f55db0df.png",
      "32": "icon32.plasmo.a826ae6e.png",
      "48": "icon48.plasmo.775d15c4.png",
      "64": "icon64.plasmo.abe633b3.png",
      "128": "icon128.plasmo.5c8d909e.png"
    },
    "default_popup": "popup.html"
  },
  "author": "Dadan",
  "version": "5.0.0",
  "background": {
    "service_worker": "static/background/index.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Record your mic, screen and camera with dadan. Share recorded video instantly with a link.",
  "permissions": [
    "storage",
    "cookies",
    "offscreen",
    "tabs",
    "downloads",
    "alarms"
  ],
  "content_scripts": [
    {
      "js": [
        "content.94f983d5.js"
      ],
      "css": [
        "font.6f151b4d.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "https://*/*",
    "http://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "assets/*",
        "assets/rnnoise/*",
        "tabs/*"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "DMSans-Regular.49880b95.woff2",
        "DMSans-Medium.9cd7091c.woff2",
        "DMSans-SemiBold.7d4d79e2.woff2",
        "DMSans-Bold.72afc08b.woff2",
        "chrome-messaging.9636441b.js",
        "logo.ab8ddf0e.svg",
        "crown.512cedb6.svg",
        "*.css",
        "*.png",
        "*.svg",
        "*.jpg"
      ]
    }
  ]
}

by ✦ Astarte

Dadan - Screen Recording & Annotation Tool

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (28 total):

Raw Manifest

Detections

Manifest Findings