Extension Details
Developer:
https://opportunitycost.app/
Rating:
4.9 ★
(28 ratings)
Users:
2,000
Context-Aware Verdict
This section provides a Claude-based AI analysis that applies additional context to the risk. Results are not guaranteed to be accurate.
HIGH
Overall Risk
Trust Factors: The extension has a decent user base of 2,000 users and maintains a strong 4.9-star rating from 28 reviews, suggesting positive user experiences. The developer provides a dedicated website (opportunitycost.app) which adds some legitimacy. However, the extension is still in early development (version 0.0.6) and lacks detailed developer information.
Concerns: The extension's broad permissions are disproportionate to what appears to be a financial calculation tool. The ability to inject content scripts into all websites creates significant security risks, as it could potentially access sensitive financial data, login credentials, or personal information across all browsing sessions. The tabs permission allows monitoring of browsing behavior, which could be used to track spending habits beyond the extension's stated purpose. The combination of these permissions with the early version number raises questions about whether such extensive access is necessary for the core functionality.
Recommendations: Consider running this extension in a separate Chrome profile dedicated to financial planning activities only. Regularly review the extension's behavior and updates given its early development stage. Monitor your browsing data and financial accounts for any unusual activity. If the extension's core functionality doesn't require access to sensitive websites like banking or shopping platforms, consider disabling it when visiting such sites. Given the high-risk permissions, evaluate whether alternative opportunity cost calculators with more limited permissions might serve your needs better.
Findings
This section provides a detailed analysis of the extension's security posture, without broader context. Assumes worst-case impact.
HIGH
Broad Content Script Injection
This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.
HIGH
High-Risk Permission: tabs
This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.
Security Analysis Details
Required Permissions:
- tabs
Embedded URLs (15 total):
| http://www.w3.org/2000/svg | https://clients2.google.com/service/update2/crx | |
| https://fonts.googleapis.com/css2?family=Orbitron:wght@400 | https://tailwindcss.com | |
| https://react.dev/errors/ | http://www.w3.org/1998/Math/MathML | |
| http://www.w3.org/1999/xlink | http://www.w3.org/XML/1998/namespace | |
| https://tftc.io/bitcoin-brief?utm_source=opportunity-cost-extension | https://www.opportunitycost.app/privacy-policy | |
| https://opportunitycost.userjot.com/ | https://radix-ui.com/primitives/docs/components/ | |
| https://www.opportunitycost.app/privacy-policy?utm_source=opportunity-cost-extension | https://www.opportunitycost.app | |
| https://www.opportunitycost.app/api/bitcoin-price |
Raw Manifest
{ "name": "Opportunity Cost", "action": { "default_icon": { "16": "icons/logo.png", "48": "icons/logo.png", "128": "icons/logo.png" }, "default_popup": "index.html", "default_title": "Opportunity Cost" }, "version": "0.0.6", "background": { "type": "module", "service_worker": "background.js" }, "options_ui": { "page": "options.html", "open_in_tab": true }, "update_url": "https://clients2.google.com/service/update2/crx", "description": "See every price in satoshis. Understand the Bitcoin opportunity cost of your purchases.", "permissions": [ "tabs" ], "content_scripts": [ { "js": [ "content.js" ], "run_at": "document_idle", "matches": [ "<all_urls>" ] } ], "manifest_version": 3 }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
Loading Secure Annex data...
Unable to load Secure Annex data.
This extension may not yet be analyzed by Secure Annex.
Detections
0Critical
0
High
0
Medium
0
Low
0
Has Verdicts
Yes
Manifest Findings
0Critical
0
High
0
Medium
0
Low
0
Secure Annex analyzed version: -