[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Whatfix Studio

Version 2026.07.20.1042 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: Whatfix Private Limited

Rating: 4.5 ★ (22 ratings)

Users: 10,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 5 total findings, including 4 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
cookies
alarms
webNavigation
scripting

Host Permissions:

*://*/*
<all_urls>
http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'; worker-src 'self';
sandbox: sandbox allow-scripts; worker-src blob:

Embedded URLs (1830 total):

https://github.com/csstree/csstree?tab=readme-ov-file#features	http://www.opensource.org/licenses/mit-license.php.
https://www.w3.org/TR/css-values-4/#component-multipliers	https://drafts.csswg.org/css-values-3/#numeric-ranges
https://www.w3.org/TR/css-syntax-3/#serialization	https://github.com/w3c/csswg-drafts/pull/6874
https://www.w3.org/TR/css-syntax-3/#anb	https://drafts.csswg.org/css-cascade-5/
https://drafts.csswg.org/css-syntax/#urange	https://drafts.csswg.org/css-values/#calc-notation
https://drafts.csswg.org/css-values-4/#custom-idents	https://developer.mozilla.org/en-US/docs/Web/CSS/custom-ident
https://drafts.csswg.org/css-variables/#typedef-custom-property-name	https://drafts.csswg.org/css-color-4/#hex-notation
https://drafts.csswg.org/css-syntax/#any-value	https://drafts.csswg.org/css-values-4/#percentages
https://drafts.csswg.org/css-values-4/#numbers	https://drafts.csswg.org/css-values-4/#integers
https://github.com/csstree/csstree/issues	https://drafts.csswg.org/css-values-4/#lengths
https://www.w3.org/TR/css-values-3/#lengths	https://drafts.csswg.org/css-values-4/#font-relative-lengths
https://drafts.csswg.org/css-values-4/#viewport-relative-lengths	https://drafts.csswg.org/css-contain-3/#container-lengths
https://www.w3.org/TR/css-values-3/#angles	https://www.w3.org/TR/css-values-3/#time
https://www.w3.org/TR/css-values-3/#frequency	https://www.w3.org/TR/css-values-3/#resolution
https://drafts.csswg.org/css-grid/#fr-unit	https://www.w3.org/TR/css3-speech/#mixing-props-voice-volume
https://www.w3.org/TR/css3-speech/#voice-props-voice-pitch	https://drafts.csswg.org/css-syntax/#declaration-diagram
https://drafts.csswg.org/mediaqueries-3/#values	https://drafts.csswg.org/css-syntax-3/
https://en.wikipedia.org/wiki/Byte_order_mark	https://drafts.csswg.org/css-syntax-3/#consume-token
https://www.w3.org/TR/css-syntax-3/	https://drafts.csswg.org/cssom/#serialize-an-identifier
https://drafts.csswg.org/cssom/#serialize-a-string	http://opensource.org/licenses/BSD-3-Clause
https://code.google.com/p/closure-compiler/source/browse/trunk/src/com/google/debugging/sourcemap/Base64VLQ.java	https://github.com/Polymer/polymer-bundler/pull/519
https://github.com/mozilla/source-map/pull/31	https://github.com/mozilla/source-map/issues/30
https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE	https://developer.chrome.com/docs/extensions/reference/alarms/
https://whatfix.atlassian.net/browse/SUCC-6316	http://www.w3.org/2000/svg
https://whatfix.com/community/#	https://whatfix.com/terms-services/
https://whatfix.com/privacy-policy/	https://support.whatfix.com/docs/manageextensionsonthewhatfixdashboard
https://support.whatfix.com/docs/triggeringliveinstructionsthroughjavascript	https://support.whatfix.com/docs/multi-languagesupport
https://support.whatfix.com/docs/structureoflanguagepropertyfiles	https://support.whatfix.com/docs/identifyingconditionsforshowingtooltips
https://support.whatfix.com/docs/branchinginawalkthrough	https://support.whatfix.com/docs/whatfixreleasenotes
https://support.whatfix.com/docs/tasklistapi	https://support.whatfix.com/docs/usingvideoplayerparameters
https://support.whatfix.com/docs/selfhelpwidgetapi	https://support.whatfix.com/docs/selfhostingwhatfixcontent
https://support.whatfix.com/x/_gAF	https://support.whatfix.com/docs/usingdynamicurlsforyourflows
https://help.whatfix.com/pages/viewpage.action?pageId=328693	https://support.whatfix.com/docs/downloadexportedflowsfromwhatfixcloudusingwhatfixapi
https://support.whatfix.com/docs/generatingtheapitoken	https://support.whatfix.com/docs/backbuttonforwalkthroughhelptips
https://support.whatfix.com/docs/settingupgoogleanalyticsfromthewhatfixdashboard	https://support.whatfix.com/studio/docs/self-hosting-whatfix-content
http://www.w3.org/1999/xlink	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xhtml	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
http://code.google.com/p/google-web-toolkit/issues/detail?id=2079	https://storage.googleapis.com/leap-np/static/images/loader_darkbg.png
https://microsoftedge.microsoft.com/addons/detail/	https://chrome.google.com/webstore/detail/
http://www.w3	http://code.google.com/p/google-web-toolkit/wiki/TroubleshootingOOPHM

Page 1 of 23

Raw Manifest

{
  "name": "Whatfix Studio",
  "icons": {
    "16": "logo16.png",
    "19": "logo19.png",
    "32": "logo32.png",
    "38": "logo38.png",
    "48": "logo48.png",
    "128": "logo128.png"
  },
  "action": {
    "default_icon": "logo19.png",
    "default_title": "Whatfix Studio"
  },
  "sandbox": {
    "pages": [
      "*/bdSandbox.html",
      "*/tmSandbox.html"
    ]
  },
  "version": "2026.07.20.1042",
  "incognito": "split",
  "background": {
    "service_worker": "extension.background/extension.background.nocache.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Create interactive guides and simulations of any web application for seamless onboarding, training and support.",
  "permissions": [
    "storage",
    "cookies",
    "alarms",
    "webNavigation",
    "scripting"
  ],
  "content_scripts": [
    {
      "js": [
        "extension.foreground/extension.foreground.nocache.js",
        "extension.foreground/mirror.foreground.js"
      ],
      "matches": [
        "*://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    }
  ],
  "host_permissions": [
    "*://*/*",
    "<all_urls>",
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts; worker-src blob:",
    "extension_pages": "script-src 'self'; object-src 'self'; worker-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "extension.foreground/*",
        "extension.background/*",
        "whatfix.com/*",
        "mirror/*",
        "env.json"
      ]
    }
  ]
}

by ✦ Astarte

Whatfix Studio

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (1830 total):

Raw Manifest

Detections

Manifest Findings