[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

Teal - Free Job Search & Contacts Tracker

Version 3.10.2 View in Chrome Web Store

Last scanned: 7 months ago | force re-scan

Extension Details

Developer: tealhq.com

Rating: 4.9 ★ (3.1K ratings)

Size: 1.54MiB

Last Updated: April 14, 2025

Users: 200,000

Developer Info: Teal Labs, Inc7800 SW 57th Ave South Miami, FL 33143-5528 US

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

- The extension is developed by a legitimate company, Teal Labs, Inc., which adds some credibility.

- It has a relatively high number of users (200,000) and a good rating (4.9/5), suggesting that many users find it useful and trustworthy.

Concerns:

- The extension has broad host permissions (http://*/*, https://*/*), allowing it to access all websites. This is a potential privacy concern as it could potentially track browsing activity or access sensitive data.

- The "activeTab" permission allows the extension to access the currently active tab, which could be a privacy risk if misused.

- The "storage" permission allows the extension to store data locally, which could be a concern if sensitive information is stored insecurely.

Recommendations:

- Consider running the extension in a separate Chrome profile or incognito mode to isolate it from your main browsing activity and sensitive data.

- Review the extension's privacy policy and terms of service to understand how your data is collected, used, and shared.

- Monitor the extension's behavior and permissions, and uninstall it if you notice any suspicious activity or privacy violations.

- Use caution when granting permissions to extensions, especially those that request broad host permissions or access to sensitive data.

- Consider using alternative job search tools or services that do not require installing a browser extension, if possible.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
alarms
storage

Host Permissions:

https://*.tealhq.com/*

Content Security Policy:

extension_pages: default-src 'self'; script-src 'self' ; style-src 'self' 'unsafe-inline'; img-src 'self' https://app.tealhq.com data:; font-src 'self'; connect-src https://auth.service.tealhq.com https://auth-staging.tealhq.com https://company.service.tealhq.com https://company-staging.tealhq.com http://localhost:3003 http://localhost:3001

Embedded URLs (81 total):

https://github.com/itfoundry/Poppins	http://scripts.sil.org/OFL
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
https://clients2.google.com/service/update2/crx	https://tealhq.com
https://app.tealhq.com	https://auth.service.tealhq.com
https://auth-staging.tealhq.com	https://company.service.tealhq.com
https://company-staging.tealhq.com	https://app.tealhq.com/
https://www.tealhq.com/	https://s3.amazonaws.com/teal.extension/config.beta.json
https://s3.amazonaws.com/teal.extension/config.json	https://auth-kermit.tealhq.com/
https://resume-kermit.tealhq.com/	https://app-kermit.tealhq.com/
https://auth-beta.tealhq.com/	https://resume-beta.tealhq.com/
https://app-beta.tealhq.com/	https://auth-staging.tealhq.com/
https://resume-staging.tealhq.com/	https://app-staging.tealhq.com/
https://auth.service.tealhq.com/	https://resume.service.tealhq.com/
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/XML/1998/namespace
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
https://jquery.com/	https://jquery.org/license
http://jedwatson.github.io/classnames	http://momentjs.com/guides/#/warnings/define-locale/
http://momentjs.com/guides/#/warnings/js-date/	http://momentjs.com/guides/#/warnings/min-max/
http://momentjs.com/guides/#/warnings/add-inverted-param/	http://momentjs.com/guides/#/warnings/zone/
http://momentjs.com/guides/#/warnings/dst-shifted/	https://radix-ui.com/primitives/docs/components/
https://radix-ui.com/primitives/docs/components/alert-dialog	https://app.posthog.com/home#panel=support%3Asupport%3A.
https://sentry.io/organizations/	https://posthog.com/docs/billing/limits-alerts
http://yandex.com/bots	https://app.posthog.com
https://us.i.posthog.com	https://us.posthog.com
https://prosemirror.net/docs/guide/#generatable	https://api2.amplitude.com/2/httpapi
https://api.eu.amplitude.com/2/httpapi	https://api2.amplitude.com/batch
https://api.eu.amplitude.com/batch	https://www.docs.developers.amplitude.com/data/sdks/browser-2/#tracking-default-events
https://sr-client-cfg.amplitude.com/config	https://sr-client-cfg.stag2.amplitude.com/config
https://sr-client-cfg.eu.amplitude.com/config	https://app.amplitude.com
https://app.eu.amplitude.com	https://apps.stag2.amplitude.com
https://www.linkedin.com/jobs/search	http://fb.me/use-check-prop-types
https://git.io/JUIaE#	https://github.com/nodeca/pako
https://github.com/date-fns/date-fns/blob/master/docs/upgradeGuide.md#string-arguments	https://raw.githubusercontent.com/jsonresume/resume-schema/v1.0.0/schema.json
https://github.com/jsonresume/resume-schema/blob/v1.0.0/schema.json	https://www.linkedin.com/company/
https://www.linkedin.com/in/	https://twitter.com/
https://www.linkedin.com/voyager/api	http://unsplash.com/
http://partner.canva.com/teal	https://careersidekick.com/linkedin-headlines-job-seekers/
https://business.linkedin.com/talent-solutions/blog/linkedin-best-practices/2016/7-linkedin-profile-summaries-that-we-love-and-how-to-boost-your-own	https://app.tealhq.com/achievement-assistant
https://www.tealhq.com/post/skills-workbook	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://quilljs.com/	https://quilljs.com

Page 1 of 2

Raw Manifest

{
  "name": "Teal - Free Job Search & Contacts Tracker",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {},
  "author": {
    "url": "https://www.tealhq.com/",
    "name": "www.tealhq.com"
  },
  "version": "3.10.2",
  "background": {
    "type": "module",
    "service_worker": "src/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "The better way to job search. Save Jobs, Contacts, Companies & Resumes in one place.",
  "permissions": [
    "activeTab",
    "alarms",
    "storage"
  ],
  "homepage_url": "https://tealhq.com",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "src/content.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "https://*.tealhq.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "default-src 'self'; script-src 'self' ; style-src 'self' 'unsafe-inline'; img-src 'self' https://app.tealhq.com data:; font-src 'self'; connect-src https://auth.service.tealhq.com https://auth-staging.tealhq.com https://company.service.tealhq.com https://company-staging.tealhq.com http://localhost:3003 http://localhost:3001"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://app.tealhq.com/*"
      ],
      "resources": [
        "content/images/logo.svg",
        "content/videos/pinning.mp4",
        "content/videos/full_process.mp4",
        "content/videos/selecting_jobs.mp4",
        "content/videos/pinning.mp4"
      ]
    },
    {
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ],
      "resources": [
        "/images/*.svg",
        "/images/*.png",
        "/fonts/*.woff",
        "style.css"
      ]
    }
  ]
}

by ✦ Astarte

Teal - Free Job Search & Contacts Tracker

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (81 total):

Raw Manifest

Detections

Manifest Findings