[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Extension for CAdES Browser Plugin

Version 1.3.17 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Rating: 3.4 ★ (28 ratings)

Users: 9,000,000

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 1 total findings, including 1 high-risk finding.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

Security Analysis Details

Required Permissions:

nativeMessaging

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self';

Embedded URLs (18 total):

http://www.w3.org/2000/svg	https://clients2.google.com/service/update2/crx
https://www.cadescompany.ru/cadesplugin	https://cadescompany.ru/cadesplugin
https://cadescompany.ru/sites/default/files/products/cades/demopage/cades_bes_sample.html	https://cadescompany.ru/sites/default/files/products/cades/demopage/webtools.html
https://cadescompany.ru/plugin-installation-windows	https://cadescompany.ru/plugin-installation-unix
https://cadescompany.ru/plugin-installation-macos	https://www.cadescompany.ru/
https://www.cadescompany.ru/forum2/	https://cadescompany.ru/support
http://www.w3.org/1999/xhtml	https://support.cryptopro.ru/index.php?/News/NewsItem/View/24/o-perekhode-rsshirenijj-dlja-bruzerov-n-bze-google-chrome-n-manifest-v3
https://www.cadescompany.ru/products/cades/plugin/get_2_0	https://www.cadescompany.ru/products/csp/downloads
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd	ftp://157.54.23.41/

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5mbPcCXE+y3R5iCmWSTHYQzsRm3BYBHYMAK8gmiK4Y3jn8wh3xTjNM6qcWJXr7bCmy+bGfNjJW1Hpr4tVPnVKv45hxZ/7dfzsRUHWxMD/ErWy6UyVYGIR+rUlS8AXSVjx/9rFKqUuaepZ0N1TgvUODaHUWpmNSKkY9o8hI3MV95WQ8FSpmCxVu9iWBjlREtSOWM+8pmvPUccFi38Y9/rvF0OR2h7zbGTMfwZFyTJuVhPL7tKO1rcbO//XM+eIGmYyWlBraEkLpmDHnDcaHjxiB95lBRpW38agTOzL0wTM8UKEA5dZdRDJWqsF8M5cyS3Wmmjmk8TenuAdImhGcU6dwIDAQAB",
  "name": "Extension for CAdES Browser Plugin",
  "icons": {
    "16": "icons/status/icon_active_16.png",
    "48": "icons/status/icon_active_48.png",
    "128": "icons/status/icon_active_128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/status/icon_not_active_16.png",
      "48": "icons/status/icon_not_active_48.png",
      "128": "icons/status/icon_not_active_128.png"
    },
    "default_popup": "popup_default.html"
  },
  "author": "CadesCompany Ltd",
  "version": "1.3.17",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Расширение позволяет использовать ЭЦП Browser plugin в браузере. Для работы требует установленного ЭЦП Browser plugin.",
  "permissions": [
    "nativeMessaging"
  ],
  "homepage_url": "https://www.cadescompany.ru/cadesplugin",
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "exclude_matches": [
        "*://*.icloud.com/*"
      ]
    }
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "105",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "nmcades_plugin_api.js",
        "trusted_sites.html",
        "icons/status/icon_not_active_16.png"
      ]
    }
  ]
}

by ✦ Astarte