[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Tripadvisor: Travel Reviews & Deals on Hotels, Restaurants & Attractions

Version 1.3.0.25 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: https://tripadvisor.com/

Rating: 4.6 ★ (107 ratings)

Users: 70,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: TripAdvisor is a well-established, legitimate travel company with a strong reputation. The extension has a good rating of 4.6 stars from 107 reviews and 70,000 users, indicating reasonable user satisfaction. The developer is verified as the official TripAdvisor domain, which adds credibility.

Concerns: Despite being from a reputable company, this extension requests extremely broad permissions that far exceed what's necessary for travel reviews and deals. The webRequest permission allows intercepting and modifying all web traffic, while webNavigation enables comprehensive browsing tracking. The universal host permissions (*://*/*) grant access to every website you visit, including banking, email, and other sensitive sites. The content script injection across all websites means the extension can read and modify any webpage content, potentially capturing passwords, personal information, or financial data. These permissions create a massive attack surface that could be exploited if the extension is compromised or if TripAdvisor's security practices are inadequate.

Recommendations: Run this extension in a completely separate Chrome profile dedicated only to travel-related browsing. Never use this profile for banking, email, work, or any sensitive activities. Consider whether you truly need the extension's functionality, as you can access TripAdvisor's services directly through their website. Monitor your accounts for any unusual activity. If possible, look for alternative travel extensions with more limited permissions, or simply bookmark TripAdvisor's website instead.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
webNavigation
unlimitedStorage
webRequest

Optional Permissions:

notifications

Host Permissions:

http://*/*
https://*/*

Embedded URLs (41 total):

https://github.com/eternicode/bootstrap-datepicker	http://www.apache.org/licenses/LICENSE-2.0
http://silviomoreto.github.io/bootstrap-select	https://github.com/silviomoreto/bootstrap-select/blob/master/LICENSE
http://getbootstrap.com	https://github.com/twbs/bootstrap/blob/master/LICENSE
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	http://gvfr.ly/47lhVs9
https://gvfr.ly/4ggyZUn	http://www.w3.org/2000/svg
http://cherne.net/brian/resources/jquery.hoverIntent.html	https://clients2.google.com/service/update2/crx
https://events.givefreely.com/popup	https://www.tripadvisor.com/api/browserextension/1.0
http://www.marriott.com/hotels/travel/	http://hamptoninn3.hilton.com/en/hotels/california/
https://www.wyndhamhotels.com/	https://www.ihg.com/holidayinn/hotels/us/en/blois/blofr/hoteldetail
https://www.hiexpress.com/hotels/us/en/west-middlesex/hgepa/hoteldetail	https://www.ihg.com/holidayinnexpress/hotels/us/en/west-middlesex/hgepa/hoteldetail
https://www.holidayinn.com/hotels/us/en/indianapolis/indml/hoteldetail	https://www.ihg.com/holidayinn/hotels/us/en/indianapolis/indml/hoteldetail
https://cdn.givefreely.com/data/behavioral/	https://geoip.maxmind.com/geoip/v2.1/country/me
https://cdn.givefreely.com/data/language	https://shop.app
https://www.ihg.com/holidayinnexpress/hotels/us/en/orlando/mcocr/hoteldetail#tabb_first_view	https://www.tripadvisor.com/ChromePrivacy
https://tripadvisor.mediaroom.com/caen-privacy-policy	http://www.travelpod.com/bin/graphics/single_pixel.gif?ce_uuid=
https://www.tripadvisor.com?m=40785	https://www.tripadvisor.com/Search
https://www.tripadvisor.com/Hotels?m=40785	https://www.tripadvisor.com/Rentals?m=40785
https://www.tripadvisor.com/CheapFlightsHome?m=40785	https://www.tripadvisor.com/Restaurants?m=40785
https://www.tripadvisor.com/Attractions?m=40785	https://www.tripadvisor.com/ForumHome?m=40785
https://www.tripadvisor.com/TravelersChoice?m=40785	https://docs.google.com/forms/d/e/1FAIpQLSf3JZ00HFweBd24oo4TkRHe6BF3ujtNStkQdRoP10rsvinR_Q/viewform?c=0&w=1
https://www.tripadvisor.com/?m=42717

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApSkAzHZ97SHvAiEWPEsRBiAoCJMqR32Gbh/5LYvNtA7vYZnZq6ue38UktWotO7GDtJW7wlqqnwG5isivftv6RGNaGs/JDoMjpCAcOQjO7ATgy+z3/PH/1dCFM97GnxcuNDOZNcaBt1GOIOAZIiFblsYRwGnz0ugTXYr3f3t3RyZeb3B9Zhp4JrVSGx7r0pG4GBImiSbCfn8lNhwXVko+YhRHYnvokuL2Wdj56HRnvWm7+UEpGjX4Ic6rW0gNm8jrghhsYMCQQJJmdHmvLjj24jK6/O/rEq7rni126llETB6wfr/ZrdGp/wU4DQbpLgByD0d011VltjBx8uEQcz0MJQIDAQAB",
  "name": "__MSG_extName__",
  "icons": {
    "16": "images/owl-16.png",
    "48": "images/owl-48.png",
    "128": "images/owl-128.png"
  },
  "action": {
    "default_icon": "images/owl-128.png",
    "default_popup": "popup.html",
    "default_title": "__MSG_extName__"
  },
  "version": "1.3.0.25",
  "background": {
    "service_worker": "new/background.js"
  },
  "options_ui": {
    "page": "options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extDesc__",
  "permissions": [
    "storage",
    "webNavigation",
    "unlimitedStorage",
    "webRequest"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "jquery-2.2.3.min.js",
        "new/vendor/GiveFreely-content.umd.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "mustache.min.js",
        "jquery.hoverIntent.minified.js",
        "on_the_web_new.js"
      ],
      "css": [
        "common.css",
        "on_the_web.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "*://*/*"
      ],
      "all_frames": false
    },
    {
      "js": [
        "adjust_widget.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "*://*/WidgetBrowserExtension-*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "jquery.hoverIntent.minified.js",
        "serp.js"
      ],
      "css": [
        "google_search.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "*://www.g.cn/*",
        "*://www.google.cn/*",
        "*://www.google.ac/*",
        "*://www.google.ad/*",
        "*://www.google.ae/*",
        "*://www.google.al/*",
        "*://www.google.am/*",
        "*://www.google.as/*",
        "*://www.google.at/*",
        "*://www.google.az/*",
        "*://www.google.ba/*",
        "*://www.google.be/*",
        "*://www.google.bf/*",
        "*://www.google.bg/*",
        "*://www.google.bi/*",
        "*://www.google.bj/*",
        "*://www.google.bs/*",
        "*://www.google.by/*",
        "*://www.google.ca/*",
        "*://www.google.cat/*",
        "*://www.google.cc/*",
        "*://www.google.cd/*",
        "*://www.google.cf/*",
        "*://www.google.cg/*",
        "*://www.google.ch/*",
        "*://www.google.ci/*",
        "*://www.google.cl/*",
        "*://www.google.cm/*",
        "*://www.google.cn/*",
        "*://www.google.co.ao/*",
        "*://www.google.co.bw/*",
        "*://www.google.co.ck/*",
        "*://www.google.co.cr/*",
        "*://www.google.co.id/*",
        "*://www.google.co.il/*",
        "*://www.google.co.in/*",
        "*://www.google.co.jp/*",
        "*://www.google.co.ke/*",
        "*://www.google.co.kr/*",
        "*://www.google.co.ls/*",
        "*://www.google.co.ma/*",
        "*://www.google.co.mz/*",
        "*://www.google.co.nz/*",
        "*://www.google.co.th/*",
        "*://www.google.co.tz/*",
        "*://www.google.co.ug/*",
        "*://www.google.co.uk/*",
        "*://www.google.co.uz/*",
        "*://www.google.co.ve/*",
        "*://www.google.co.vi/*",
        "*://www.google.co.za/*",
        "*://www.google.co.zm/*",
        "*://www.google.co.zw/*",
        "*://www.google.com/*",
        "*://www.google.com.af/*",
        "*://www.google.com.ag/*",
        "*://www.google.com.ai/*",
        "*://www.google.com.ar/*",
        "*://www.google.com.au/*",
        "*://www.google.com.bd/*",
        "*://www.google.com.bh/*",
        "*://www.google.com.bn/*",
        "*://www.google.com.bo/*",
        "*://www.google.com.br/*",
        "*://www.google.com.by/*",
        "*://www.google.com.bz/*",
        "*://www.google.com.co/*",
        "*://www.google.com.cu/*",
        "*://www.google.com.cy/*",
        "*://www.google.com.do/*",
        "*://www.google.com.ec/*",
        "*://www.google.com.eg/*",
        "*://www.google.com.et/*",
        "*://www.google.com.fj/*",
        "*://www.google.com.gh/*",
        "*://www.google.com.gi/*",
        "*://www.google.com.gt/*",
        "*://www.google.com.hk/*",
        "*://www.google.com.jm/*",
        "*://www.google.com.kh/*",
        "*://www.google.com.kh/*",
        "*://www.google.com.kw/*",
        "*://www.google.com.lb/*",
        "*://www.google.com.lc/*",
        "*://www.google.com.ly/*",
        "*://www.google.com.mt/*",
        "*://www.google.com.mx/*",
        "*://www.google.com.my/*",
        "*://www.google.com.na/*",
        "*://www.google.com.nf/*",
        "*://www.google.com.ng/*",
        "*://www.google.com.ni/*",
        "*://www.google.com.np/*",
        "*://www.google.com.om/*",
        "*://www.google.com.pa/*",
        "*://www.google.com.pe/*",
        "*://www.google.com.pg/*",
        "*://www.google.com.ph/*",
        "*://www.google.com.pk/*",
        "*://www.google.com.pr/*",
        "*://www.google.com.py/*",
        "*://www.google.com.qa/*",
        "*://www.google.com.sa/*",
        "*://www.google.com.sb/*",
        "*://www.google.com.sg/*",
        "*://www.google.com.sl/*",
        "*://www.google.com.sv/*",
        "*://www.google.com.tj/*",
        "*://www.google.com.tn/*",
        "*://www.google.com.tr/*",
        "*://www.google.com.tw/*",
        "*://www.google.com.ua/*",
        "*://www.google.com.uy/*",
        "*://www.google.com.vc/*",
        "*://www.google.com.vn/*",
        "*://www.google.cv/*",
        "*://www.google.cz/*",
        "*://www.google.de/*",
        "*://www.google.dj/*",
        "*://www.google.dk/*",
        "*://www.google.dm/*",
        "*://www.google.dz/*",
        "*://www.google.ee/*",
        "*://www.google.es/*",
        "*://www.google.fi/*",
        "*://www.google.fm/*",
        "*://www.google.fr/*",
        "*://www.google.ga/*",
        "*://www.google.ge/*",
        "*://www.google.gf/*",
        "*://www.google.gg/*",
        "*://www.google.gl/*",
        "*://www.google.gm/*",
        "*://www.google.gp/*",
        "*://www.google.gr/*",
        "*://www.google.gy/*",
        "*://www.google.hn/*",
        "*://www.google.hr/*",
        "*://www.google.ht/*",
        "*://www.google.hu/*",
        "*://www.google.ie/*",
        "*://www.google.im/*",
        "*://www.google.io/*",
        "*://www.google.iq/*",
        "*://www.google.is/*",
        "*://www.google.it/*",
        "*://www.google.je/*",
        "*://www.google.jo/*",
        "*://www.google.kg/*",
        "*://www.google.ki/*",
        "*://www.google.kz/*",
        "*://www.google.la/*",
        "*://www.google.li/*",
        "*://www.google.lk/*",
        "*://www.google.lt/*",
        "*://www.google.lu/*",
        "*://www.google.lv/*",
        "*://www.google.md/*",
        "*://www.google.me/*",
        "*://www.google.mg/*",
        "*://www.google.mk/*",
        "*://www.google.ml/*",
        "*://www.google.mn/*",
        "*://www.google.ms/*",
        "*://www.google.mu/*",
        "*://www.google.mv/*",
        "*://www.google.mw/*",
        "*://www.google.ne/*",
        "*://www.google.nl/*",
        "*://www.google.no/*",
        "*://www.google.nr/*",
        "*://www.google.nu/*",
        "*://www.google.pl/*",
        "*://www.google.pn/*",
        "*://www.google.ps/*",
        "*://www.google.pt/*",
        "*://www.google.ro/*",
        "*://www.google.rs/*",
        "*://www.google.ru/*",
        "*://www.google.rw/*",
        "*://www.google.sc/*",
        "*://www.google.se/*",
        "*://www.google.sh/*",
        "*://www.google.si/*",
        "*://www.google.sk/*",
        "*://www.google.sm/*",
        "*://www.google.sn/*",
        "*://www.google.so/*",
        "*://www.google.st/*",
        "*://www.google.td/*",
        "*://www.google.tg/*",
        "*://www.google.tk/*",
        "*://www.google.tl/*",
        "*://www.google.tm/*",
        "*://www.google.to/*",
        "*://www.google.tt/*",
        "*://www.google.ua/*",
        "*://www.google.us/*",
        "*://www.google.vg/*",
        "*://www.google.vn/*",
        "*://www.google.vu/*",
        "*://www.google.ws/*"
      ],
      "all_frames": false,
      "exclude_globs": [
        "*://*.google.*/uds/afs*"
      ]
    },
    {
      "js": [
        "gf-widget.js"
      ],
      "css": [],
      "run_at": "document_idle",
      "matches": [
        "*://www.google.com/*",
        "*://www.google.co.uk/*",
        "*://www.google.com.au/*",
        "*://www.google.co.in/*",
        "*://www.google.ca/*"
      ],
      "all_frames": false,
      "exclude_globs": [
        "*://*.google.*/uds/afs*"
      ]
    },
    {
      "js": [
        "givefreely.js"
      ],
      "css": [],
      "run_at": "document_idle",
      "matches": [
        "*://*/*"
      ],
      "all_frames": false,
      "exclude_globs": []
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "notifications"
  ],
  "web_accessible_resources": [
    {
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "resources": [
        "newuser-en.html",
        "pricewatcher.html",
        "options.html",
        "images/*",
        "fonts/*"
      ]
    }
  ]
}

by ✦ Astarte

Tripadvisor: Travel Reviews & Deals on Hotels, Restaurants & Attractions

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (41 total):

Raw Manifest

Detections

Manifest Findings