CRXaminer

[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Version 1.1.14 View in Chrome Web Store

Last scanned: 18 days ago | force re-scan

Extension Details

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 6 total findings, including 5 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
storage
downloads
*://*.aliyuncs.com/*
declarativeNetRequest
alarms

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
sandbox: sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; child-src 'self';

Embedded URLs (50 total):

http://www.w3.org/2000/svg	https://t.uncledesk.com/saasbox/resources/png/default-skin__e3f799c6dec9af194c86decdf7392405.png
https://t.uncledesk.com/saasbox/resources/svg/default-skin__b257fa9c5ac8c515ac4d77a667ce2943.svg	https://t.uncledesk.com/saasbox/resources/gif/preloader__e34aafbb485a96eaf2a789b2bf3af6fe.gif
https://cdn.zbaseglobal.com/zbase/test/2021/discord-line.svg	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
https://extensionpay.com	https://github.com/Glench/ExtPay#2-configure-your-manifestjson
https://github.com/zloirock/core-js/blob/v3.47.0/LICENSE	https://github.com/zloirock/core-js
https://feross.org	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://jquery.com/	https://jquery.org/license
http://www.w3.org/1999/xlink	http://www.w3.org/1998/Math/MathML
https://lodash.com/	https://js.foundation/
https://lodash.com/license	http://underscorejs.org/LICENSE
https://npms.io/search?q=ponyfill.	http://element.eleme.io/#/zh-CN/component/upload#yong-hu-tou-xiang-shang-chuan
https://feross.org/opensource	http://feross.org
https://player.vimeo.com/	https://player.vimeo.com
https://vimeo.com/ondemand	https://player.vimeo.com/video/
https://player.vimeo.com/video	https://vimeo.com/
https://vimeo.com	https://en.wikipedia.org/wiki/Dynamic_Adaptive_Streaming_over_HTTP
https://en.wikipedia.org/wiki/HTTP_Live_Streaming	https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/GET
https://ffmpeg.org/download.html	https://emscripten.org/docs/compiling/Dynamic-Linking.html
https://simpledownloader.io/vimeo/vimeo-config?	https://cdn.zbaseglobal.com/saasbox/resources/png/f08ecb23-0058-4dd5-b300-1da7b76eb6d1__84b93dd2487099c3c52cd21ea4ad7f5d.png
https://cdn.zbaseglobal.com/saasbox/resources/png/%E6%88%AA%E5%B1%8F2022-09-22-%E4%B8%8A%E5%8D%889.41.07__e10461fca0fc829fb3f224c331f71495.png	https://www.youtube.com/watch?v=r1AtmY-RMyQ
https://www.youtube.com/watch?v=zl4vo0dhLRk	https://chrome.google.com/webstore/detail/penndbmahnpapepljikkjmakcobdahne
https://cdn.zbaseglobal.com/saasbox/resources/png/%E6%88%AA%E5%B1%8F2022-09-26-%E4%B8%8B%E5%8D%884.37.52__d0c12f006c48322d1a89f623a6961f56.png	https://cdn.zbaseglobal.com/saasbox/resources/png/%E6%88%AA%E5%B1%8F2022-09-23-%E4%B8%8B%E5%8D%882.05.57-1__b11bcbc7cb6be30b0390170eedff7139.png
https://chrome.google.com/webstore/detail/simple-downloader-for-vim/emnnbocicckplplepjjojfkmiodfdjaf	https://vimeomate.com/blog/download-vimeo-private-videos
https://chrome.google.com/webstore/detail/emnnbocicckplplepjjojfkmiodfdjaf	https://microsoftedge.microsoft.com/addons/detail/hobdeidpfblapjhejaaigpicnlijdopo/reviews
https://chrome.google.com/webstore/detail/emnnbocicckplplepjjojfkmiodfdjaf/reviews	https://clients2.google.com/service/update2/crx

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "128": "icons/logo.png"
  },
  "merge": "merge.html",
  "action": {
    "default_icon": {
      "128": "icons/logo.png"
    },
    "default_popup": "popup.html",
    "default_title": "__MSG_extName__"
  },
  "version": "1.1.14",
  "background": {
    "service_worker": "js/background.js"
  },
  "options_ui": {
    "page": "option.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extDes__",
  "permissions": [
    "tabs",
    "storage",
    "downloads",
    "*://*.aliyuncs.com/*",
    "declarativeNetRequest",
    "alarms"
  ],
  "homepage_url": "https://chrome.google.com/webstore/detail/penndbmahnpapepljikkjmakcobdahne",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/content-script-vimeo.js"
      ],
      "css": [
        "css/insert-vimeo.css"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    },
    {
      "js": [
        "js/content-inject.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.vimeo.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "js/content-script-volume.js"
      ],
      "run_at": "document_end",
      "matches": [
        "*://*.vimeo.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "js/content-script-turn.js"
      ],
      "run_at": "document_end",
      "matches": [
        "*://*.vimeo.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "js/content-script-picture.js"
      ],
      "run_at": "document_end",
      "matches": [
        "*://*.vimeo.com/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "sandbox": "sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; child-src 'self';",
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self';"
  },
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_1",
        "path": "rule.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "icons/*",
        "css/price.css",
        "pay.html"
      ]
    },
    {
      "matches": [
        "*://*.vimeo.com/*"
      ],
      "resources": [
        "js/ajax-listener.js"
      ]
    }
  ]
}

by ✦ Astarte

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (50 total):

Raw Manifest

Detections

Manifest Findings