[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Redux DevTools

Version 3.2.10 View in Chrome Web Store

Last scanned: 12 days ago | force re-scan

Extension Details

Rating: 4.6 ★ (741 ratings)

Users: 1,000,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

Redux DevTools is a legitimate and widely-used developer tool with over 1 million users and a strong 4.6-star rating. It's an official debugging tool for Redux state management in web applications, making it a trusted utility in the developer community. The high user count and positive ratings suggest it's a well-established extension.

Concerns:

The extension's broad permissions are concerning given its nature as a development tool. While Redux DevTools legitimately needs to inject scripts and access websites to monitor Redux state, the extensive host permissions (file://*/*, http://*/*, https://*/*) and content script injection across all URLs create significant attack surface. These permissions could theoretically be exploited to access sensitive data on any website you visit, not just those you're debugging. The notifications, contextMenus, and storage permissions, while less critical, add additional capabilities that expand the potential impact.

Recommendations:

Since this is a development tool, consider using it only in a dedicated Chrome profile for development work, separate from your personal browsing. This limits exposure of personal accounts and sensitive sites. Alternatively, only enable the extension when actively debugging Redux applications and disable it during regular browsing. For production environments, ensure this extension is never installed on machines handling sensitive data.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

notifications
contextMenus
storage

Host Permissions:

file:///*
http://*/*
https://*/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'; style-src * 'unsafe-inline'; img-src 'self' data:;

Embedded URLs (83 total):

https://redux.js.org/Errors?code=	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xhtml	https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#
http://json-schema.org/draft-07/schema#	http://json-schema.org/draft-07/schema
http://json-schema.org/schema	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://mozilla.github.io/localForage/#definedriver	https://git.io/JUIaE#
http://github.com/idleberg	https://github.com/janniks
http://atelierbram.github.io/syntax-highlighting/atelier-schemes/dune	http://atelierbram.github.io/syntax-highlighting/atelier-schemes/forest
http://atelierbram.github.io/syntax-highlighting/atelier-schemes/heath	http://atelierbram.github.io/syntax-highlighting/atelier-schemes/lakeside/
http://atelierbram.github.io/syntax-highlighting/atelier-schemes/seaside/	http://github.com/tpoisot
http://chriskempson.com	http://clrs.cc
http://sethawright.com	https://github.com/alexx2/
http://github.com/alexx2/	http://www.monokai.nl
http://github.com/nicinabox	http://railscasts.com
http://tybenz.com	http://ethanschoonover.com/solarized
http://cscorley.github.io/	http://hart-dev.com
https://github.com/zalmoxisus	http://github.com/tilal6991
http://github.com/mikebarkmin	http://timotheepoisot.fr
http://www.kreativekorp.com	https://github.com/voronianski/oceanic-next-color-scheme
http://leetless.de/vim.html	http://www.lexaloffle.com/pico-8.php
https://chuck.harmston.ch	https://github.com/nashamri/spacemacs-theme
https://jcornwall.com	https://github.com/reduxjs/redux-devtools/blob/main/README.md
https://github.com/reduxjs/redux-devtools/discussions	https://twitter.com/NathanBierema
https://opencollective.com/redux-devtools-extension	http://www.w3.org/2000/xmlns/
https://github.com/zalmoxisus/redux-devtools-extension/blob/master/docs/Features/Trace.md	https://bit.ly/3cXEKWf
https://redux-toolkit.js.org/Errors?code=	https://redux-toolkit.js.org/rtk-query/overview#basic-usage
https://github.com/reduxjs/redux-devtools/blob/main/extension/docs/API/Arguments.md#actioncreators	https://github.com/zalmoxisus/redux-devtools-extension#usage
https://github.com/zalmoxisus/redux-devtools-extension/blob/master/docs/Troubleshooting.md#access-file-url-file	https://github.com/jonschlinkert/es6-template-regex
http://lodash.com/	http://ecma-international.org/ecma-262/6.0/#sec-template-literal-lexical-components
https://github.com/jonschlinkert/is-extendable	https://github.com/jonschlinkert/get-value
https://github.com/tunnckoCore/es6-template	http://www.tunnckocore.tk
https://github.com/jonschlinkert/shallow-clone	https://github.com/jonschlinkert/isobject
https://github.com/jonschlinkert/is-plain-object	https://feross.org/opensource
https://feross.org	https://localforage.github.io/localForage
https://lodash.com/	https://openjsf.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
http://goo.gl/7AJzbL	https://github.com/reduxjs/redux-devtools
https://www.google	https://clients2.google.com/service/update2/crx
https://github.com/zalmoxisus/redux-devtools-extension/pull/54#issuecomment-188167725	https://github.com/zalmoxisus/redux-devtools-extension/blob/master/docs/API/Arguments.md

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsdJEPwY92xUACA9CcDBDBmbdbp8Ap3cKQ0DJTUuVQvqb4FQAv8RtKY3iUjGvdwuAcSJQIZwHXcP2aNDH3TiFik/NhRK2GRW8X3OZyTdkuDueABGP2KEX8q1WQDgjX/rPIinGYztUrvoICw/UerMPwNW62jwGoVU3YhAGf+15CgX2Y6a4tppnf/+1mPedKPidh0RsM+aJY98rX+r1SPAHPcGzMjocLkqcT75DZBXer8VQN14tOOzRCd6T6oy7qm7eWru8lJwcY66qMQvhk0osqEod2G3nA7aTWpmqPFS66VEiecP9PgZlp8gQdgZ3dFhA62exydlD55JuRhiMIR63yQIDAQAB",
  "name": "Redux DevTools",
  "icons": {
    "16": "img/logo/16x16.png",
    "48": "img/logo/48x48.png",
    "128": "img/logo/128x128.png"
  },
  "action": {
    "default_icon": "img/logo/gray.png",
    "default_popup": "devpanel.html#popup",
    "default_title": "Redux DevTools"
  },
  "version": "3.2.10",
  "commands": {
    "_execute_action": {
      "suggested_key": {
        "default": "Ctrl+Shift+E"
      }
    },
    "devtools-remote": {
      "description": "Remote DevTools"
    },
    "devtools-window": {
      "description": "DevTools window"
    }
  },
  "background": {
    "service_worker": "background.bundle.js"
  },
  "options_ui": {
    "page": "options.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Redux DevTools for debugging application's state changes.",
  "permissions": [
    "notifications",
    "contextMenus",
    "storage"
  ],
  "homepage_url": "https://github.com/reduxjs/redux-devtools",
  "devtools_page": "devtools.html",
  "content_scripts": [
    {
      "js": [
        "content.bundle.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "exclude_globs": [
        "https://www.google*"
      ]
    },
    {
      "js": [
        "page.bundle.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "exclude_globs": [
        "https://www.google*"
      ]
    }
  ],
  "host_permissions": [
    "file:///*",
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "ids": [
      "*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'; style-src * 'unsafe-inline'; img-src 'self' data:;"
  }
}

by ✦ Astarte

Redux DevTools

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (83 total):

Raw Manifest

Detections

Manifest Findings