[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Bookmarks Backuper

Version 0.2.1.1 View in Chrome Web Store

Last scanned: 4 days ago | force re-scan

Extension Details

Developer: bookmarksbackuper.com

Rating: 3.9 ★ (45 ratings)

Users: 2,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a modest user base of 2,000 users with a decent 3.9-star rating from 45 reviews, suggesting some level of user satisfaction. The developer uses a domain-specific website (bookmarksbackuper.com) which adds some legitimacy. The CSP policy is well-configured with strict security measures and only allows connections to legitimate services like Google APIs and Dropbox.

Concerns: The extension requests highly sensitive permissions that align with its stated purpose but create significant privacy risks. The identity permission allows access to your Google account information, while bookmarks permission provides full read/write access to all your bookmarks. The combination of these permissions means the extension can both access your personal browsing patterns stored in bookmarks and potentially link this data to your identity. The relatively small user base and limited review count make it harder to assess long-term reliability and security practices.

Recommendations: Consider running this extension in a separate Chrome profile to isolate it from your main browsing data. Before installation, verify that bookmarksbackuper.com is a legitimate website with proper privacy policies. Monitor the extension's behavior after installation and revoke permissions if you notice any suspicious activity. Consider whether you truly need automated bookmark backup functionality, as manual export might be safer for sensitive bookmark collections. Regularly review what data the extension has access to through Chrome's extension management settings.

Findings

HIGH

High-Risk Permission: bookmarks

This extension has the bookmarks permission. Can access and modify bookmarks. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

identity
bookmarks
storage

Content Security Policy:

extension_pages: require-trusted-types-for 'script'; trusted-types 'none'; child-src 'none'; connect-src https://accounts.google.com https://api.dropboxapi.com https://chromewebstore.google.com https://clouderrorreporting.googleapis.com https://docs.google.com https://sheets.googleapis.com https://www.dropbox.com https://www.googleapis.com; default-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'none'; script-src-elem 'nonce-bb_nonce'; script-src-attr 'none'; style-src 'none'; style-src-elem 'nonce-bb_nonce'; style-src-attr 'none'; worker-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'

Embedded URLs (49 total):

https://developer.chrome.com/docs/extensions/reference/api/bookmarks#property-BookmarkTreeNode-parentId	https://developer.chrome.com/docs/extensions/reference/api/bookmarks#property-BookmarkTreeNode-url
https://clouderrorreporting.googleapis.com/v1beta1/projects/%s/events:report	https://chromewebstore.google.com/detail/bookmarks-backuper/jdcbhaadjnkcdklbjkmgbpjaoonekpjd/reviews
https://docs.google.com/spreadsheets/d/%s/edit	https://sheets.googleapis.com/v4/spreadsheets/%s/values/A2:D:clear
https://sheets.googleapis.com/v4/spreadsheets/%s/values/A2:D	https://www.googleapis.com/drive/v3/files
https://sheets.googleapis.com/v4/spreadsheets	https://www.googleapis.com/drive/v3/files/%s
https://accounts.google.com/o/oauth2/revoke?token=%s	https://www.dropbox.com/oauth2/authorize
https://api.dropboxapi.com/oauth2/token	https://api.dropboxapi.com/2/auth/token/revoke
https://api.dropboxapi.com/2/file_properties/templates/list_for_user	https://api.dropboxapi.com/2/file_properties/templates/add_for_user
https://api.dropboxapi.com/2/file_properties/templates/get_for_user	https://api.dropboxapi.com/2/file_properties/properties/add
https://api.dropboxapi.com/2/file_properties/properties/search	https://api.dropboxapi.com/2/files/paper/create
https://api.dropboxapi.com/2/files/paper/update	https://api.dropboxapi.com/2/sharing/get_file_metadata
https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Objects/Object_prototypes#using_a_constructor	https://tc39.es/ecma262/#sec-time-values-and-time-range
https://2ality.com/2014/05/is-integer.html	https://tc39.es/ecma262/#integral-number
https://cloud.google.com/error-reporting/reference/rest/v1beta1/projects.events/report#response-body	https://clients2.google.com/service/update2/crx
https://accounts.google.com	https://api.dropboxapi.com
https://chromewebstore.google.com	https://clouderrorreporting.googleapis.com
https://docs.google.com	https://sheets.googleapis.com
https://www.dropbox.com	https://www.googleapis.com
https://www.googleapis.com/auth/drive.file	https://cloud.google.com/storage/docs/exponential-backoff
https://developers.google.com/workspace/drive/api/guides/performance#partial-response	https://developers.google.com/workspace/drive/api/guides/fields-parameter
https://cloud.google.com/apis/docs/system-parameters#definitions	https://www.dropbox.com/developers/documentation/http/documentation#oauth2-token
https://www.dropbox.com/developers/documentation/http/documentation#oauth2-authorize	https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
https://www.dropbox.com/developers/documentation/http/documentation#error-handling	http://status.dropbox.com
https://community.zapier.com/how-do-i-3/google-sheets-creates-new-row-copies-formatting-from-previous-row-when-adding-manychat-options-2094	https://www.dropbox.com/oauth2/authorize?client_id=
https://www.dropbox.com/developers/documentation/http/documentation#auth-token-revoke

Raw Manifest

{
  "name": "Bookmarks Backuper",
  "icons": {
    "16": "img/icon128.png",
    "48": "img/icon128.png",
    "128": "img/icon128.png"
  },
  "action": {
    "default_popup": "popup.html",
    "default_title": "Show Bookmarks Backuper"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/drive.file"
    ],
    "client_id": "788587416670-d3i89ech7a4pv33qas2stflslookq0el.apps.googleusercontent.com"
  },
  "version": "0.2.1.1",
  "background": {
    "service_worker": "service_worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Never lose your Chrome bookmarks again!",
  "permissions": [
    "identity",
    "bookmarks",
    "storage"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "require-trusted-types-for 'script'; trusted-types 'none'; child-src 'none'; connect-src https://accounts.google.com https://api.dropboxapi.com https://chromewebstore.google.com https://clouderrorreporting.googleapis.com https://docs.google.com https://sheets.googleapis.com https://www.dropbox.com https://www.googleapis.com; default-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'none'; script-src-elem 'nonce-bb_nonce'; script-src-attr 'none'; style-src 'none'; style-src-elem 'nonce-bb_nonce'; style-src-attr 'none'; worker-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
  }
}

by ✦ Astarte

Bookmarks Backuper

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (49 total):

Raw Manifest

Detections

Manifest Findings