[ new scan ] [ statistics ] [ github ] [ twitter ]

WOT: Website Security & Safety Checker

Version 5.8.3 View in Chrome Web Store

Last scanned: 2 days ago | force re-scan

Extension Details

Developer: mywot.com

Rating: 4.5 ★ (10.6K ratings)

Size: 5.75MiB

Last Updated: March 13, 2025

Users: 800,000

Context-Aware Verdict

MEDIUM

Risk Level

Trust Factors:

- The extension is developed by mywot.com, a reputable company focused on website security and safety ratings.

- It has a large user base of 800,000 users, indicating widespread adoption and trust.

- The extension has a high rating of 4.5 stars from over 10,000 reviews, suggesting user satisfaction.

Concerns:

- The extension requests several high-risk permissions like tabs, webNavigation, and webRequest, which could potentially be abused for tracking or compromising user privacy and security.

- It has broad host permissions to access all websites, raising privacy concerns about potential data collection.

Recommendations:

- While the extension appears to be from a reputable source and has a legitimate use case for website security checking, users should exercise caution due to the requested high-risk permissions.

- Users may consider running the extension in a separate browser profile or incognito mode to isolate its access and minimize potential risks.

- Regularly check for updates from the developer and review any changes to the extension's permissions or behavior.

- Consider using alternative website security tools or services that request fewer high-risk permissions if privacy is a major concern.

Security Analysis

CRITICAL

Overall Risk

Based on 6 total findings, ranked without considering overall context, including 4 high-risk and 2 medium-risk findings.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
contextMenus
webNavigation
webRequest
declarativeNetRequest
declarativeNetRequestFeedback
storage
scripting
alarms

Host Permissions:

http://www.mywot.com/*
http://api.mywot.com/*
https://api.mywot.com/*
http://*/*
https://*/*

Content Security Policy:

extension_pages: style-src 'self' 'unsafe-inline' http://fonts.googleapis.com; script-src 'self' ; object-src 'self'; img-src * data:;

Embedded URLs (115 total):

https://fonts.gstatic.com	https://fonts.googleapis.com/css2?family=Roboto:wght@400
https://npms.io/search?q=ponyfill.	https://cdn.growthbook.io
https://example.com	http://www.w3.org/2000/svg
https://fb.me/react-warning-keys	http://bit.ly/redux-logger-options
https://secure.mywot.com	https://secure.mywot.com/content/config
https://registry.npmjs.org/mixpanel/-/mixpanel-0.17.0.tgz	https://github.com/mixpanel/mixpanel-node/issues
https://github.com/mixpanel/mixpanel-node	http://www.w3.org/TR/SVG11/feature#BasicStructure
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://scorecard.api.mywot.com	https://static.mywot.com/settings/extensions
https://app.mywot.com/api/analytics/sync	https://fonts.googleapis.com/css2?family=Montserrat:wght@500
https://chromewebstore.google.com/	https://microsoftedge.microsoft.com/addons
https://addons.mozilla.org	https://addons.opera.com
https://api.mywot.com/	https://score.mywot.com/scores
https://user.api.mywot.com/v3/registerClient	https://user.api.mywot.com/v3/user/isPremium
https://user.api.mywot.com/v3/user/getFeature	https://analytics.api.mywot.com/event
https://leak.api.mywot.com/scanEmails	https://analytics.api.mywot.com/reportClientData
https://user.api.mywot.com/updateMailListTags	https://user.api.mywot.com/v3/user/isTrialing
https://analytics.api.mywot.com/reportClientError	https://www.google-analytics.com/mp/collect?
https://growthbook.mywot.com	https://auth.api.mywot.com
https://fonts.googleapis.com/css2?family=Montserrat:wght@400	https://sketchapp.com
http://www.bohemiancoding.com/sketch	https://cdn.jsdelivr.net/npm/@growthbook/growthbook@1.4.1/dist/bundles/index.js
https://bugs.chromium.org/p/v8/issues/detail?id=4118	https://bugs.chromium.org/p/v8/issues/detail?id=3056
http://fb.me/use-check-prop-types	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is
https://fb.me/react-warning-dont-call-proptypes	http://fb.me/prop-types-in-prod
https://github.com/facebook/fbjs/blob/e66ba20ad5be433eb54423f2b097d829324d9de6/packages/fbjs/src/__forks__/warning.js	https://github.com/facebook/react/issues/3236
https://fb.me/react-special-props	https://reactjs.org/docs/react-api.html#createelement
https://reactjs.org/docs/react-api.html#createfactory	https://reactjs.org/docs/react-api.html#cloneelement
https://reactjs.org/docs/react-api.html#isvalidelement	https://reactjs.org/docs/react-api.html#reactchildrenforeach
https://reactjs.org/docs/react-api.html#reactchildrenmap	https://reactjs.org/docs/react-api.html#reactchildrencount
https://reactjs.org/docs/react-api.html#reactchildrentoarray	https://reactjs.org/docs/react-api.html#reactchildrenonly
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	http://facebook.github.io/react/docs/error-decoder.html?invariant=
https://cdn.jsdelivr.net/npm/webext-redux@4.0.0/dist/webext-redux.js	https://lodash.com/
https://jquery.org/	https://lodash.com/license
http://underscorejs.org/LICENSE	http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring
http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero	http://ecma-international.org/ecma-262/7.0/#sec-object.keys
http://ecma-international.org/ecma-262/7.0/#sec-tolength	http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types
https://github.com/reactjs/redux/blob/master/src/compose.js	http://fonts.googleapis.com
http://www.mywot.com/	http://api.mywot.com/
http://clients2.google.com/service/update2/crx	http://www.google.com/s2/favicons?domain=

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "images/16x16.png",
    "18": "images/18x18.png",
    "20": "images/20x20.png",
    "24": "images/24x24.png",
    "32": "images/32x32.png",
    "40": "images/40x40.png",
    "48": "images/48x48.png",
    "96": "images/96x96.png",
    "128": "images/128x128.png"
  },
  "action": {
    "default_icon": {
      "20": "images/20x20.png",
      "40": "images/40x40.png",
      "48": "images/48x48.png"
    },
    "default_popup": "",
    "default_title": "__MSG_appTooltip__"
  },
  "author": "MyWOT",
  "version": "5.8.3",
  "background": {
    "service_worker": "./background.js"
  },
  "short_name": "Web of Trust",
  "update_url": "http://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDescription__",
  "permissions": [
    "tabs",
    "contextMenus",
    "webNavigation",
    "webRequest",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "storage",
    "scripting",
    "alarms"
  ],
  "options_page": "options.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "scripts/crossbrowser.js",
        "libs/lodash.min.js",
        "libs/react.min.js",
        "libs/react-dom.min.js",
        "libs/react-redux.min.js",
        "libs/webext-redux.js",
        "libs/react-custom-scrollbar.js",
        "libs/bodymovin-lottie-engine.js",
        "libs/growthbook.js",
        "scripts/shared/constants.js",
        "scripts/shared/fonts.js",
        "scripts/shared/utils.js",
        "scripts/shared/wotCrypto.js",
        "scripts/shared/wotApi.js",
        "scripts/shared/lottieAnimation.js",
        "scripts/shared/titleWithTooltip.js",
        "scripts/shared/growthbook.js",
        "scripts/background/app/actions.js",
        "scripts/content/components/common/warningReportsContainer.js",
        "scripts/content/components/common/ratingStars.js",
        "scripts/content/components/common/buttonAction.js",
        "scripts/content/components/common/reputationBubble.js",
        "scripts/content/components/assistant/preCheckAssistant.js",
        "scripts/content/components/assistant/popup.js",
        "scripts/content/components/assistant/assistantPopup.js",
        "scripts/content/components/shield/shield.js",
        "scripts/content/components/shield/shieldOnBoarding.js",
        "scripts/content/components/serpPopup/ScorecardData.js",
        "scripts/content/components/serpPopup/OptOutSerpPopup.js",
        "scripts/content/components/serpPopup/scorecardLink.js",
        "scripts/content/components/serpPopup/SerpPopupFooter.js",
        "scripts/content/components/serpWarning/serpWarning.js",
        "scripts/content/components/serpWarning/mailOffering.js",
        "scripts/shared/scheduler.js",
        "scripts/content/components/leakHook/leakHook.js",
        "scripts/content/components/idTheftHookInGmail/idTheftHookInGmail.js",
        "scripts/content/components/warning/warningAttributes.js",
        "scripts/content/components/warning/warningActionsContainer.js",
        "scripts/content/components/warning/warningMessageContainer.js",
        "scripts/content/components/warning/warningStrip.js",
        "scripts/content/components/warning/optoutStrip.js",
        "scripts/content/components/warning/badRatingNotification.js",
        "scripts/content/components/warning/warning.js",
        "scripts/content/addReviewHandler.js",
        "scripts/content/components/common/extendHandler.js",
        "scripts/content/components/common/previewHandler.js",
        "scripts/content/preCheckAssistantHandler.js",
        "scripts/content/serpHandler.js",
        "scripts/content/redirectHandler.js",
        "scripts/content/sharingHandler.js",
        "scripts/content/warningHandler.js",
        "scripts/content/leakHookHandler.js",
        "scripts/content/socialAuthHandler.js",
        "scripts/shared/getPremium.js",
        "scripts/shared/statelessFunctions.js",
        "scripts/shared/statelessFunctionsComponents.js",
        "scripts/content/popup/sliderManager.js",
        "scripts/content/popup/serpPopupManager.js",
        "scripts/content/index.js",
        "scripts/shared/pinWotPopup/pinPopupHandler.js",
        "scripts/shared/pinWotPopup/pinPopupContainer.js",
        "scripts/content/popupV2/popupOnboardingHandler.js",
        "scripts/content/popupV2/popupOnboarding.js",
        "scripts/content/popupV2/popupContentArea.js",
        "scripts/content/popupV2/popupMainContainer.js"
      ],
      "css": [
        "styles/content.css"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "scripts/content/extInfo.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.mywot.com/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "http://www.mywot.com/*",
    "http://api.mywot.com/*",
    "https://api.mywot.com/*",
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "style-src 'self' 'unsafe-inline' http://fonts.googleapis.com; script-src 'self' ; object-src 'self'; img-src * data:;"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "images/*.svg",
        "images/*.png",
        "images/*.gif",
        "styles/*.css",
        "images/animations/*.json",
        "resources/*.json",
        "popupV2.html",
        "addReview.html",
        "loggedOut.html",
        "breachInfo.html"
      ],
      "extension_ids": []
    }
  ]
}

WOT: Website Security & Safety Checker

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (115 total):

Raw Manifest

Secure Annex (beta)