[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Olto

Version 1.5.9 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Rating: 5.0 ★ (7 ratings)

Users: 91

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: This extension presents significant trust concerns. With only 91 users and just 7 ratings, it has an extremely small user base that makes it difficult to assess real-world safety. The lack of developer information and company details raises additional red flags about accountability and transparency. While the 5.0 rating appears positive, the sample size is too small to be meaningful.

Concerns: The extension requests an excessive combination of powerful permissions that create a perfect storm for malicious activity. The ability to inject scripts into all websites combined with access to cookies, navigation tracking, and tab manipulation creates opportunities for credential theft, session hijacking, and comprehensive browsing surveillance. The unsafe WebAssembly execution policy is particularly concerning as it could hide malicious code. The broad host permissions across all URLs mean this extension has unrestricted access to every website you visit, including banking, email, and other sensitive sites.

Recommendations: Do not install this extension. The risk-to-benefit ratio is unacceptable given the unknown developer, minimal user base, and dangerous permission combination. If you absolutely must use it, create a completely separate Chrome profile with no saved passwords or sensitive browsing data, and never access important accounts while the extension is active. Consider looking for established alternatives with larger user bases and transparent developers that provide similar functionality with more limited permissions.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

scripting
tabs
storage
webNavigation
cookies

Host Permissions:

https://*/*
http://*/*
<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self';

Embedded URLs (28 total):

https://olto.com/msa	https://github.com/faker-js/faker
https://fakerjs.dev/guide/localization.html	https://github.com/faker-js/faker/issues/1785#issuecomment-1407773744
https://picsum.photos	https://via.placeholder.com
https://source.unsplash.com	https://avatars.githubusercontent.com/u/
https://cloudflare-ipfs.com/ipfs/Qmd3W5DuhgHirLHGVixi6V76LhCkZUz6pnFt5AJBiyvHye/avatar/	https://loremflickr.com/
https://picsum.photos/seed/	http://www.w3.org/2000/svg
https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xhtml	https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@100
https://npms.io/search?q=ponyfill.	https://app.olto.com
https://cdn.growthbook.io	https://github.com/puleos/object-hash/issues/26
http://github.com/dominictarr/crypto-browserify	https://rt.growthbook.io/?key=
http://fb.me/use-check-prop-types	https://clients2.google.com/service/update2/crx

Raw Manifest

{
  "name": "Olto",
  "icons": {
    "16": "icons/favicon16.png",
    "32": "icons/favicon32.png",
    "128": "icons/favicon.png"
  },
  "action": {
    "default_popup": "src/popup/popup.html"
  },
  "version": "1.5.9",
  "background": {
    "type": "module",
    "service_worker": "service-worker-loader.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "AI for Personalized Demos",
  "permissions": [
    "scripting",
    "tabs",
    "storage",
    "webNavigation",
    "cookies"
  ],
  "content_scripts": [
    {
      "js": [
        "assets/ContentScript.ts-loader-6e97f882.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "https://*/*",
    "http://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://*.olto.com/*",
      "https://*.growthbook.io/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "resources": [
        "assets/generateMessageId-232f56ee.js",
        "assets/ProfileClass-da872b9a.js",
        "assets/index.d-cd706b6f.js",
        "assets/unmountCard-f190602c.js",
        "assets/lodash-d175ed82.js",
        "assets/index.d-92679ccb.js",
        "assets/ContentScript.ts-351cc97a.js",
        "assets/Olto-IBMPlexSans-Thin-a7c1db95.woff2",
        "assets/Olto-IBMPlexSans-ThinItalic-71869f30.woff2",
        "assets/Olto-IBMPlexSans-ExtraLight-4fbfec40.woff2",
        "assets/Olto-IBMPlexSans-ExtraLightItalic-9f5b128c.woff2",
        "assets/Olto-IBMPlexSans-Light-1546365d.woff2",
        "assets/Olto-IBMPlexSans-LightItalic-89913bce.woff2",
        "assets/Olto-IBMPlexSans-Regular-ecfc5b17.woff2",
        "assets/Olto-IBMPlexSans-RegularItalic-42727809.woff2",
        "assets/Olto-IBMPlexSans-Medium-032f2da3.woff2",
        "assets/Olto-IBMPlexSans-MediumItalic-c12f4ae5.woff2",
        "assets/Olto-IBMPlexSans-SemiBold-bd900ecb.woff2",
        "assets/Olto-IBMPlexSans-SemiBoldItalic-413dab7b.woff2",
        "assets/Olto-IBMPlexSans-Bold-4798117d.woff2",
        "assets/Olto-IBMPlexSans-BoldItalic-c46d288f.woff2",
        "assets/memory-replays-orchestrator-8b0140bc.js",
        "assets/index.d-fc5b1659.js",
        "assets/olto-capture-engine-871e392b.js",
        "assets/ReplaysContentScript.ts-f00c936a.js",
        "assets/ReplaysIFrameContentScript.ts-5ad0a7c7.js"
      ],
      "use_dynamic_url": false
    }
  ]
}

by ✦ Astarte

Olto

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (28 total):

Raw Manifest

Detections

Manifest Findings