[ new scan ] [ statistics ] [ github ] [ twitter ]

Malwarebytes Browser Guard Beta

Version 3.0.23 View in Chrome Web Store

Last scanned: 17 days ago | force re-scan

Extension Details

Rating: 3.2 ★ (18 ratings)

Users: 10,000

Context-Aware Verdict

MEDIUM

Risk Level

Trust Factors:

- The extension is published by the reputable cybersecurity company Malwarebytes, which adds some trust.

- It has a relatively high number of users (10,000), suggesting some level of popularity and trust from the user community.

- However, the extension is still in beta, which could indicate potential issues or instability.

Concerns:

- The extension requests several high-risk permissions, including downloads, tabs, webRequest, and the ability to inject content scripts into any website. These permissions could potentially be abused for malicious purposes, such as compromising security, privacy, or modifying website content.

- The extension also has broad host permissions (<all_urls>), allowing it to access any website, which could enable tracking or data theft.

- The "Critical" overall risk rating from the security findings is concerning, even though the extension is from a reputable company.

Recommendations:

- Exercise caution when using this extension, as it has broad permissions and the potential for misuse or security vulnerabilities.

- Consider running the extension in a separate browser profile or a sandboxed environment to isolate it from your main browsing activities.

- Monitor the extension's behavior and any updates or security advisories from Malwarebytes.

- If you don't require the extension's functionality, consider disabling or removing it until it exits the beta phase and potential security concerns are addressed.

- Provide feedback to Malwarebytes about the extension's permissions and any concerns you may have, as they may be able to address them in future updates.

Security Analysis

CRITICAL

Overall Risk

Based on 9 total findings, ranked without considering overall context, including 5 high-risk and 4 medium-risk findings.

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

alarms
downloads
storage
tabs
declarativeNetRequest
declarativeNetRequestFeedback
unlimitedStorage
webRequest
contextMenus
nativeMessaging
offscreen
activeTab

Optional Permissions:

clipboardRead
clipboardWrite

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (503 total):

http://www.example.com	https://708a324f1a7ec87a2658346fb4bb7586@o438337.ingest.sentry.io/4506062147551232
http://www.w3.org/1998/Math/MathML	http://www.w3.org/2000/svg
http://www.w3.org/1999/xhtml	https://www.malwarebytes.com/browserguard/download-debug-logs?yes=true
https://github.com/getsentry/sentry-javascript/issues/2286	https://github.com/getsentry/sentry-javascript/issues/5459
https://github.com/getsentry/sentry-javascript/issues/7813	https://github.com/zloirock/core-js/blob/1b944df55282cdc99c90db5f49eb0b6eda2cc0a3/packages/core-js/internals/global.js
https://docs.sentry.io/platforms/javascript/best-practices/multiple-sentry-instances/	https://docs.sentry.io/platforms/javascript/best-practices/browser-extensions/
https://github.com/getsentry/sentry-javascript/blob/develop/MIGRATION.md#deprecate-hub	https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues#typedarray
https://github.com/getsentry/sentry-javascript/issues/8935	http://stackoverflow.com/questions/105034/how-to-create-a-guid-uuid-in-javascript/2117523#2117523
https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string	https://faisalman.github.io/ua-parser-js
https://github.com/faisalman/ua-parser-js	https://developer.mozilla.org/en-US/docs/Web/API/Performance
https://github.com/getsentry/sentry-javascript/issues/2590	https://github.com/mdn/content/issues/4713
https://dev.to/noamr/when-a-millisecond-is-not-a-millisecond-3h6	https://github.com/getsentry/sentry-javascript/issues/2590.
https://github.com/getsentry/sentry/blob/master/src/sentry/lang/javascript/processor.py#L67	https://github.com/getsentry/sentry-javascript/pull/8981
https://gist.github.com/thejohnfreeman/563337119e20d090ea2d22bee9b05a6b	https://caniuse.com/#feat=referrer-policy
https://github.com/getsentry/raven-js/issues/1233	https://github.com/angular/angular.js/pull/13945/files
https://github.com/getsentry/sentry-javascript/issues/3344	https://github.com/bugsnag/bugsnag-js/issues/469
https://github.com/getsentry/sentry-javascript/issues/2572.	https://github.com/getsentry/sentry/blob/9f08305e09866c8bd6d0c24f5b0aabdd7dd6c59c/src/sentry/lang/javascript/errormapping.py#L83-L108
https://github.com/getsentry/sentry-javascript/issues/1949	https://developer.mozilla.org/en-US/docs/Web/API/DOMError
https://developer.mozilla.org/en-US/docs/Web/API/DOMException	https://webidl.spec.whatwg.org/#es-DOMException-specialness
https://github.com/getsentry/sentry-javascript/issues/1168	https://github.com/getsentry/sentry-javascript/pull/7404
https://github.com/getsentry/sentry-javascript/pull/4196	https://github.com/getsentry/sentry-javascript/issues/838
https://tools.ietf.org/html/rfc3986#appendix-B	https://develop.sentry.dev/sdk/data-handling/#structuring-data
https://developer.mozilla.org/en-US/docs/Web/API/PromiseRejectionEvent	https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent
https://github.com/getsentry/sentry-javascript/issues/2380	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/AggregateError
https://github.com/getsentry/sentry-javascript/issues/6880	https://developer.mozilla.org/en-US/docs/Web/API/Headers/get
https://fetch.spec.whatwg.org/#http-network-or-cache-fetch	https://github.com/getsentry/sentry-javascript/pull/7553
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/readyState	https://docs.sentry.io/platforms/javascript/configuration/filtering/
https://stackoverflow.com/questions/105034/create-guid-uuid-in-javascript	https://stackoverflow.com/a/13007065/4875295
https://download.instalki.co.uk	https://whytho.cool.instalki.co.uk
https://rfrs38m9.s3.us-east-2.amazonaws.com/	https://datatracker.ietf.org/doc/html/rfc8878#section-3.1.1
https://regexr.com/5n86j	https://crap.crap
https://bugs.chromium.org/p/chromium/issues/detail?id=31262#c13	https://developer.chrome.com/extensions/downloads#type-DangerType
https://bugzilla.mozilla.org/show_bug.cgi?id=511624	https://fonts.googleapis.com/css?family=Roboto&display=swap
https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType	http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries
https://www.w3.org/TR/xhtml1/normative.html#strict	https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-
https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible	http://www.w3.org/TR/xml/#d0e804
https://github.com/sindresorhus/validate-element-name	https://gist.github.com/101arrowz/a979452d4355992cbf8f257cbffc9edd
https://developer.mozilla.org/en-US/docs/Web/API/LockedFile/abort	https://developer.mozilla.org/en-US/docs/Web/API/Blob
https://developer.mozilla.org/en/docs/Web/API/DOMRequest	https://developer.mozilla.org/en-US/docs/Web/API/File
https://developer.mozilla.org/en-US/docs/Web/API/IDBMutableFile	https://developer.mozilla.org/en-US/docs/Web/API/IDBRequest

Page 1 of 7

Raw Manifest

{
  "name": "Malwarebytes Browser Guard Beta",
  "icons": {
    "16": "app/assets/bg-icon/bg-favicon-16x16.png",
    "32": "app/assets/bg-icon/bg-favicon-32x32.png",
    "48": "app/assets/bg-icon/bg-favicon-48x48.png",
    "64": "app/assets/bg-icon/bg-favicon-64x64.png",
    "96": "app/assets/bg-icon/bg-favicon-96x96.png",
    "200": "app/assets/bg-icon/bg-favicon-200x200.png",
    "256": "app/assets/bg-icon/bg-favicon-256x256.png",
    "512": "app/assets/bg-icon/bg-favicon-512x512.png"
  },
  "action": {
    "default_icon": {
      "16": "app/assets/bg-icon/bg-favicon-16x16.png",
      "32": "app/assets/bg-icon/bg-favicon-32x32.png",
      "48": "app/assets/bg-icon/bg-favicon-48x48.png",
      "64": "app/assets/bg-icon/bg-favicon-64x64.png",
      "96": "app/assets/bg-icon/bg-favicon-96x96.png",
      "200": "app/assets/bg-icon/bg-favicon-200x200.png",
      "256": "app/assets/bg-icon/bg-favicon-256x256.png",
      "512": "app/assets/bg-icon/bg-favicon-512x512.png"
    },
    "default_popup": "app/pop.html",
    "default_title": "Malwarebytes"
  },
  "author": "Malwarebytes",
  "version": "3.0.23",
  "incognito": "split",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "alarms",
    "downloads",
    "storage",
    "tabs",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "unlimitedStorage",
    "webRequest",
    "contextMenus",
    "nativeMessaging",
    "offscreen",
    "activeTab"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content-debugging.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://www.malwarebytes.com/browserguard/*",
        "https://browserguard.local/*"
      ]
    },
    {
      "js": [
        "content-scripts.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "injection-tss-mv3.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "match_about_blank": true
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "clipboardRead",
    "clipboardWrite"
  ],
  "externally_connectable": {
    "matches": [
      "*://*.malwarebytes.com/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "mbgc.mv3.whitelist_1",
        "path": "db/mbgc.mv3.whitelist_1.json",
        "enabled": true
      },
      {
        "id": "mbgc.mv3.ads_1",
        "path": "db/mbgc.mv3.ads_1.json",
        "enabled": false
      },
      {
        "id": "mbgc.mv3.ads_2",
        "path": "db/mbgc.mv3.ads_2.json",
        "enabled": false
      },
      {
        "id": "mbgc.mv3.malware_1",
        "path": "db/mbgc.mv3.malware_1.json",
        "enabled": false
      },
      {
        "id": "mbgc.mv3.easylist_1",
        "path": "db/mbgc.mv3.easylist_1.json",
        "enabled": false
      },
      {
        "id": "mbgc.mv3.easyprivacy_1",
        "path": "db/mbgc.mv3.easyprivacy_1.json",
        "enabled": false
      },
      {
        "id": "mbgc.arw",
        "path": "db/mbgc.arw.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "*.eot",
        "*.ttf",
        "*.woff",
        "*.woff2"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "app/assets/close-icon.svg",
        "app/assets/tooltip.svg",
        "app/eventpages/block.html",
        "app/eventpages/block-content-control.html",
        "app/eventpages/block-mv3.html",
        "app/eventpages/debugger.html",
        "app/eventpages/downloading.html",
        "app/eventpages/block-notification.html",
        "app/eventpages/breach-notification.html",
        "app/eventpages/block-notification.css",
        "app/eventpages/block-notification-dark.css",
        "app/eventpages/breach-notification.css",
        "app/eventpages/breach-notification-dark.css",
        "app/eventpages/monthly-notification.html",
        "app/eventpages/monthly-notification.css",
        "app/eventpages/monthly-notification-dark.css",
        "app/assets/check-icon.svg",
        "app/assets/check-icon-dark.svg",
        "app/eventpages/release-notification.html",
        "app/eventpages/release-notification.css",
        "app/eventpages/release-notification-dark.css",
        "app/eventpages/clipboard-notification.html",
        "app/eventpages/clipboard-notification.css",
        "app/eventpages/clipboard-notification-dark.css",
        "app/eventpages/search-hijacking-notification.html",
        "app/eventpages/search-hijacking-notification.css",
        "app/eventpages/search-hijacking-notification-dark.css",
        "injection-instart.js",
        "injection-tss-mv3.js",
        "injection-tss-notification.js",
        "injection-topics.js",
        "injection-tss-skimmer.js",
        "offscreen/offscreen.html",
        "vendor/*",
        "app/content-style.css",
        "app/app.html"
      ],
      "use_dynamic_url": false
    }
  ]
}

Malwarebytes Browser Guard Beta

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (503 total):

Raw Manifest

Secure Annex (beta)