Extension Details
Context-Aware Verdict
The extension has a solid user rating of 4.9 stars from 22 reviews, indicating positive user experiences. With 4,000 users, it has a reasonable adoption rate for a specialized sports tracking tool. The extension appears to serve a legitimate purpose for MLB baseball fans who want to track games and statistics.
The storage permission, while necessary for saving user preferences and tracking data, could potentially be used to collect and store personal information beyond what's needed for baseball tracking functionality. The contextMenus permission allows the extension to modify your right-click menu, which could be intrusive if not implemented thoughtfully. The lack of detailed developer information makes it difficult to assess the publisher's credibility and data handling practices.
The combination of storage and contextMenus permissions creates moderate privacy and user experience concerns, though these permissions are reasonable for a sports tracking application that likely needs to save user preferences and provide quick access features.
Monitor what data the extension stores by checking Chrome's extension storage settings periodically. Be aware of any new context menu items added by the extension. Consider the extension's necessity - if you only occasionally check baseball scores, web-based alternatives might be safer. The medium risk level suggests the extension is generally safe for most users, but those with high privacy concerns should evaluate whether the convenience justifies the permissions requested.
Findings
Security Analysis Details
Required Permissions:
- alarms
- storage
- contextMenus
Embedded URLs (13 total):
| https://stackoverflow.com/questions/10491448/how-to-access-jquery-in-html-5-web-worker/33944817#33944817 | https://statsapi.mlb.com | |
| https://www.mlb.com/gameday/ | https://www.mlb.com/scores | |
| https://clients2.google.com/service/update2/crx | https://momentjs.com/timezone/docs/#/use-it/browser/ | |
| http://momentjs.com/timezone/docs/#/data-loading/. | http://momentjs.com/guides/#/warnings/define-locale/ | |
| http://momentjs.com/guides/#/warnings/js-date/ | http://momentjs.com/guides/#/warnings/min-max/ | |
| http://momentjs.com/guides/#/warnings/add-inverted-param/ | http://momentjs.com/guides/#/warnings/zone/ | |
| http://momentjs.com/guides/#/warnings/dst-shifted/ |
Raw Manifest
{ "name": "MLB Baseball Tracker", "icons": { "128": "logos/mlb.png" }, "action": { "128": "logos/mlb.png" }, "version": "3.1", "background": { "service_worker": "background.js" }, "short_name": "MlbBaseballTracker", "update_url": "https://clients2.google.com/service/update2/crx", "description": "Adds an icon with your selected MLB team's game information with real-time score and in-game data.", "permissions": [ "alarms", "storage", "contextMenus" ], "offline_enabled": false, "manifest_version": 3, "web_accessible_resources": [ { "matches": [ "*://*/*" ], "resources": [ "logos/*", "numbers/*" ], "extension_ids": [ "ojihcoimmhapanmaglfhjfddoniigjpg", "pbhopjnalckkgcigcfohmiinmhaamldl" ] } ] }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.