CRX aminer

Starting analysis...

Extension icon

ESUIT | Un Seen for Facebook™

Version 1.11.5 View in Chrome Web Store

Last scanned: 6 months ago | force re-scan

Extension Details

Developer: esuit.dev
Rating: 4.6 ★ (187 ratings)
Users: 20,000

Context-Aware Verdict

MEDIUM
Overall Risk
Trust Factors:

The extension has a solid user base of 20,000 users with a good rating of 4.6/5 from 187 reviews, indicating general user satisfaction. The developer uses a professional domain (esuit.dev) and the extension serves a specific privacy-focused purpose for Facebook users who want to read messages without triggering read receipts.

Concerns:

The primary concern is the broad host permissions that grant access to Facebook's main domains and Messenger. While these permissions align with the extension's stated functionality, they provide significant access to sensitive social media data including private messages, posts, and personal information. The scripting permission allows code execution on these platforms, and the storage permission enables data retention locally. The declarativeNetRequest permission could potentially modify network requests to Facebook services.

The combination of these permissions creates a powerful capability set that, while necessary for the extension's functionality, could be misused to collect private communications, personal data, or browsing patterns on Facebook platforms.

Recommendations:

Consider running this extension in a separate Chrome profile dedicated to Facebook use to limit potential data exposure from other browsing activities. Regularly review the extension's behavior and updates. If you frequently use Facebook for sensitive communications or business purposes, evaluate whether the privacy benefit of unseen message reading outweighs the security risks of granting such broad access to your social media data.

Findings

HIGH
Broad Host Permissions
This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.
MEDIUM
Access to Sensitive Domains
This extension requests access to sensitive domains: https://www.facebook.com/*, https://web.facebook.com/*. Ensure you trust this extension with access to these sites.
MEDIUM
Medium-Risk Permission: storage
This extension has the storage permission. Can store data locally.