[ new scan ] [ statistics ] [ github ] [ twitter ]

Bookmarker by start.me

Version 7.3.0 View in Chrome Web Store

Last scanned: about 15 hours ago

Extension Details

Developer: start.me

Rating: 4.8 ★ (34 ratings)

Users: 5,000

Context-Aware Verdict

LOW

Risk Level

Trust Factors:

- The extension is developed by start.me, a reputable company known for its start page service.

- It has a relatively high rating of 4.8 stars from 34 reviews, indicating user satisfaction.

- The extension has a moderate user base of 5,000 users.

Concerns:

- The storage permission allows the extension to store data locally, which could potentially be misused to store sensitive information.

- The activeTab permission grants access to the active tab when the extension icon is clicked, which could be used for tracking or modifying the user's browsing behavior.

- The contextMenus permission allows the extension to add items to the context menu, which could be used for advertising or other unwanted purposes.

Recommendations:

- While the permissions raise some concerns, the extension's reputation and user ratings suggest that it is likely safe to use.

- However, it is recommended to exercise caution and avoid storing sensitive information in the extension or clicking on any suspicious context menu items.

- If you have concerns, you can run the extension in a separate Chrome profile or consider using an alternative bookmarking tool.

- Regularly check for updates and reviews to ensure the extension remains trustworthy.

Security Analysis

MEDIUM

Overall Risk

Based on 3 total findings, ranked without considering overall context, including 0 high-risk and 3 medium-risk findings.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
activeTab
contextMenus

Optional Permissions:

bookmarks
tabs

Host Permissions:

https://start.me/

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (228 total):

http://purl.org/dc/elements/1.1/	http://creativecommons.org/ns#
http://www.w3.org/1999/02/22-rdf-syntax-ns#	http://www.w3.org/2000/svg
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	http://www.inkscape.org/namespaces/inkscape
http://purl.org/dc/dcmitype/StillImage	https://github.com/zloirock/core-js/blob/v3.21.0/LICENSE
https://github.com/zloirock/core-js	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
https://start.me/search/google-startme?q=	https://support.start.me
https://support.start.me/hc/en-us/articles/360018563880-Extension-Bookmarker-by-start-me	https://tc39.es/ecma262/#sec-regexp.prototype.test
https://tc39.es/ecma262/#sec-object.getownpropertydescriptor	https://tc39.es/ecma262/#sec-lengthofarraylike
https://tc39.es/ecma262/#sec-arrayspeciescreate	https://tc39.es/ecma262/#sec-getsubstitution
http://werxltd.com/wp/2010/05/13/javascript-implementation-of-javas-string-hashcode-method/	https://tc39.es/ecma262/#sec-regexpexec
https://tc39.es/ecma262/#sec-iscallable	https://tc39.es/ecma262/#sec-array.prototype.foreach
https://tc39.es/ecma262/#sec-hasownproperty	https://tc39.es/ecma262/#sec-requireobjectcoercible
https://github.com/zloirock/core-js/issues/677	https://tc39.es/ecma262/#sec-object.getownpropertynames
https://tc39.es/ecma262/#sec-regexp.prototype.tostring	https://tc39.es/ecma262/#sec-get-regexp.prototype.sticky
https://github.com/zloirock/core-js/issues/624	https://tc39.es/ecma262/#sec-object.defineproperties
https://tc39.es/ecma262/#sec-string.prototype-@@iterator	https://tc39.es/ecma262/#sec-%stringiteratorprototype%.next
https://github.com/mozilla/rhino/issues/346	https://tc39.es/ecma262/#sec-array.prototype-@@unscopables
https://tc39.es/ecma262/#sec-isregexp	https://tc39.es/ecma262/#sec-speciesconstructor
https://tc39.es/ecma262/#sec-ordinarytoprimitive	https://tc39.es/ecma262/#sec-string.prototype.trim
https://tc39.es/ecma262/#sec-regexp-constructor	https://tc39.es/ecma262/#sec-get-regexp-@@species
https://tc39.es/ecma262/#sec-array.prototype.includes	https://tc39.es/ecma262/#sec-array.prototype.indexof
https://tc39.es/ecma262/#sec-array.prototype.filter	https://tc39.es/ecma262/#sec-array.prototype.sort
https://tc39.es/ecma262/#sec-tolength	https://stackoverflow.com/questions/6024666/getting-ie-to-replace-a-regex-with-the-literal-string-0
https://tc39.es/ecma262/#sec-string.prototype.replace	https://tc39.es/ecma262/#sec-regexp.prototype-@@replace
https://pastebin.com/N21QzeQA	https://tc39.es/ecma262/#sec-string.prototype.trimstart
https://tc39.es/ecma262/#sec-string.prototype.trimend	https://tc39.es/ecma262/#sec-tointegerorinfinity
https://tc39.es/ecma262/#sec-object.assign	https://tc39.es/ecma262/#sec-string.prototype.codepointat
https://github.com/mathiasbynens/String.prototype.at	https://tc39.es/ecma262/#sec-isconstructor
https://tc39.es/ecma262/#sec-toobject	https://github.com/zloirock/core-js/issues/475
https://github.com/es-shims/es5-shim/issues/150	https://github.com/kitcambridge/es5-shim/commit/4f738ac066346
https://tc39.es/ecma262/#sec-object.create	https://tc39.es/ecma262/#sec-advancestringindex
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume	https://github.com/facebook/regenerator/issues/274
http://mozilla.org/MPL/2.0/.	https://github.com/mozilla/webextension-polyfill/issues/130
https://github.com/zloirock/core-js/issues/679	https://tc39.es/ecma262/#sec-array.prototype.concat
https://tc39.es/ecma262/#sec-object.defineproperty	https://github.com/zloirock/core-js/issues/1008
https://bugzilla.mozilla.org/show_bug.cgi?id=773687	https://tc39.es/ecma262/#sec-topropertykey
https://github.com/zloirock/core-js/issues/173	https://code.google.com/p/v8/issues/detail?id=687
https://tc39.es/ecma262/#sec-symbol-constructor	https://github.com/tc39/proposal-Symbol-description
https://tc39.es/ecma262/#sec-symbol.for	https://tc39.es/ecma262/#sec-symbol.keyfor
https://tc39.es/ecma262/#sec-object.getownpropertydescriptors	https://tc39.es/ecma262/#sec-object.getownpropertysymbols

Page 1 of 3

Raw Manifest

{
  "name": "__MSG_APP_NAME__",
  "icons": {
    "16": "icons/icon16.png",
    "19": "icons/icon19.png",
    "32": "icons/icon32.png",
    "38": "icons/icon38.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_icon": {
      "19": "icons/icon19.png",
      "38": "icons/icon38.png"
    },
    "browser_style": false,
    "default_popup": "popup.html",
    "default_title": "__MSG_ADD_TO_STARTME__"
  },
  "author": "start.me",
  "omnibox": {
    "keyword": "me"
  },
  "version": "7.3.0",
  "commands": {
    "_execute_action": {
      "description": "__MSG_ADD_TO_STARTME__",
      "suggested_key": {
        "mac": "Alt+B",
        "default": "Alt+B"
      }
    },
    "open_startme_homepage": {
      "description": "__MSG_OPEN_STARTME_HOMEPAGE__",
      "suggested_key": {
        "mac": "Alt+H",
        "default": "Alt+H"
      }
    }
  },
  "incognito": "split",
  "background": {
    "type": "module",
    "service_worker": "js/background.js"
  },
  "options_ui": {
    "page": "popup.html#options",
    "open_in_tab": false,
    "browser_style": true
  },
  "short_name": "__MSG_APP_SHORT_NAME__",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_APP_DESCRIPTION__",
  "permissions": [
    "storage",
    "activeTab",
    "contextMenus"
  ],
  "homepage_url": "https://start.me",
  "default_locale": "en",
  "offline_enabled": false,
  "host_permissions": [
    "https://start.me/"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "bookmarks",
    "tabs"
  ],
  "externally_connectable": {
    "ids": [
      "*"
    ],
    "matches": [
      "*://localhost/*",
      "*://*.start.me/*",
      "*://*.startme.com/*"
    ]
  },
  "minimum_chrome_version": "88",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "popup.html",
        "welcome.html",
        "import.html",
        "options.html"
      ]
    }
  ]
}

Bookmarker by start.me

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (228 total):

Raw Manifest

Secure Annex (beta)