[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Sound Booster - increase volume up

Version 1.0.10 View in Chrome Web Store

Last scanned: about 1 month ago | force re-scan

Extension Details

Developer: https://sound-ultimate.com/

Rating: 4.5 ★ (10.7K ratings)

Users: 2,000,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has a substantial user base of 2 million users and maintains a solid 4.5-star rating from over 10,000 reviews, suggesting general user satisfaction. The developer operates from a dedicated domain (sound-ultimate.com) which adds some legitimacy. However, the extension's core functionality - audio volume boosting - should theoretically require minimal permissions.

Concerns:

The most significant red flag is the excessive permissions requested for what should be a simple audio enhancement tool. The combination of tabs permission, broad host permissions (<all_urls>), and content script injection across all websites creates a powerful surveillance and data collection capability. These permissions far exceed what's necessary for volume boosting functionality. The tabCapture permission, while potentially legitimate for audio processing, combined with the other permissions creates concerning data access potential. The system.display permission also seems unnecessary for audio enhancement.

Recommendations:

Consider running this extension in a separate Chrome profile to isolate potential privacy risks. Before installation, verify if your audio needs can be met through system-level volume controls or less permissive alternatives. If you proceed with installation, regularly review the extension's behavior and consider removing it if you notice unusual network activity or performance issues. Monitor your browsing data and be cautious about sensitive activities while this extension is active.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "__MSG_app_name__",
  "icons": {
    "16": "icons/icon-logo.png",
    "32": "icons/icon-logo.png",
    "48": "icons/icon-logo.png",
    "128": "icons/icon-logo.png"
  },
  "action": {
    "default_icon": {
      "19": "icons/icon-logo.png",
      "38": "icons/icon-logo.png"
    },
    "default_title": "__MSG_app_name__"
  },
  "version": "1.0.10",
  "background": {
    "service_worker": "js/service_worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_app_description__",
  "permissions": [
    "tabs",
    "tabCapture",
    "storage",
    "system.display"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/libs/jquery.min.js",
        "js/content.js"
      ],
      "css": [
        "css/content.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "*.css"
      ]
    }
  ]
}

by ✦ Astarte

https://jquery.com/	https://sizzlejs.com/
https://jquery.org/license	https://js.foundation/
https://microsoftedge.microsoft.com/addons/detail/	https://chrome.google.com/webstore/detail/
https://clients2.google.com/service/update2/crx

Sound Booster - increase volume up

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (7 total):

Raw Manifest

Detections

Manifest Findings