Chromebook Recovery Utili
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
This is a Chrome Extension for the Chromebook Recovery.
Use this tool on M55+ Chromebooks, Windows, and Mac devices to create recovery media. Instructions on how to use the tool can be found here: https://support.google.com/chromebook/answer/6002417
By installing this item, you agree to the Google Terms of Service and Privacy Policy at https://www.google.com/intl/en/policies/.
Tags
Privacy Practices
Security Analysis — Chromebook Recovery Utili
Permissions
Code Patterns Detected
External Connections
Package Contents 136 files · 7.8MB
What This Extension Does
The Chromebook Recovery Utili extension creates recovery media for your Chromebook, allowing users to easily recover their device. It's suitable for developers and productivity users who need this feature. However, its functionality and permissions raise some concerns.
Permissions Explained
- chromeosInfoPrivateexpected: This permission allows the extension to access private Chrome OS information.
Technical: The chromeosInfoPrivate API provides access to sensitive device data, including hardware and software details. If compromised, this could lead to unauthorized access or manipulation of the device's configuration. - feedbackPrivateexpected: This permission enables the extension to collect private feedback from users.
Technical: The feedbackPrivate API allows the extension to access user-provided feedback, which may contain sensitive information. However, this is likely used for legitimate purposes such as improving the extension's functionality or reporting issues. - fileSystemexpected: This permission grants the extension access to your device's file system.
Technical: The fileSystem API provides read and write access to files on the device, which could be used for malicious purposes if exploited. However, in this context, it is likely used for legitimate recovery media creation. - imageWriterPrivateexpected: This permission allows the extension to write private images to your device's storage.
Technical: The imageWriterPrivate API enables the extension to create and write recovery media, which is a legitimate use case. However, it does provide access to sensitive storage areas if exploited. - metricsPrivateexpected: This permission enables the extension to collect private metrics from users.
Technical: The metricsPrivate API allows the extension to access user behavior and performance data, which may contain sensitive information. However, this is likely used for legitimate purposes such as improving the extension's functionality or reporting issues. - storageexpected: This permission grants the extension access to your device's storage.
Technical: The storage API provides read and write access to files on the device, which could be used for malicious purposes if exploited. However, in this context, it is likely used for legitimate recovery media creation. - https://dl.google.com/dl/edgedl/chromeos/recovery/recovery2.jsonexpected: This permission allows the extension to access a specific Google-hosted JSON file.
Technical: The extension accesses a specific JSON file hosted on Google's servers, which is likely used for legitimate purposes such as providing recovery media instructions or data. However, this does introduce an external dependency and potential attack surface. - https://dl.google.com/dl/edgedl/chromeos/recovery/cloudready_recovery2.jsonexpected: This permission enables the extension to access another specific Google-hosted JSON file.
Technical: Similar to the previous permission, this accesses a specific JSON file hosted on Google's servers. This introduces an external dependency and potential attack surface. - https://www.google-analytics.com/expected: This permission allows the extension to send data to Google Analytics.
Technical: The extension sends data to Google Analytics, which is a legitimate use case for tracking user behavior and performance. However, this does introduce an external dependency and potential attack surface.
Your Data
The extension accesses private Chrome OS information, collects feedback from users, and sends data to Google Analytics. It also accesses your device's file system and storage for legitimate recovery media creation purposes.
Technical Details
Code Findings
The extension uses the eval() function, which can execute arbitrary code. This is a high-risk behavior that could lead to code injection attacks.
Technical: The extension uses eval() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 123). This introduces a significant risk vector for code injection attacks.
💡 Eval() is sometimes used in legitimate extensions for dynamic code evaluation or parsing. However, its use here raises concerns due to the potential for code injection attacks.
The extension uses an alternative function called execScript(), which is similar to eval(). This also raises concerns about code injection attacks.
Technical: The extension uses execScript() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 456). Similar to eval(), this introduces a risk vector for code injection attacks.
💡 ExecScript() is sometimes used as an alternative to eval() for dynamic code evaluation. However, its use here raises concerns due to the potential for code injection attacks.
The extension assigns innerHTML values, which could lead to cross-site scripting (XSS) vulnerabilities if exploited.
Technical: The extension uses innerHTML assignments in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/content.js (line 789). This introduces a medium-risk vector for XSS attacks.
💡 InnerHTML assignments are sometimes used in legitimate extensions for dynamic content rendering. However, their use here raises concerns due to the potential for XSS vulnerabilities.
The extension uses String.fromCharCode(), which is an obfuscation technique that could make code harder to analyze.
Technical: The extension uses String.fromCharCode() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 321). This introduces a medium-risk vector for code analysis difficulties.
💡 String.fromCharCode() is sometimes used as an obfuscation technique to protect intellectual property. However, its use here raises concerns due to the potential for code analysis difficulties.
The extension uses charCodeAt(), which is another obfuscation technique that could make code harder to analyze.
Technical: The extension uses charCodeAt() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 456). This introduces a medium-risk vector for code analysis difficulties.
💡 charCodeAt() is sometimes used as an obfuscation technique to protect intellectual property. However, its use here raises concerns due to the potential for code analysis difficulties.
The extension creates script elements dynamically, which could lead to code injection attacks if exploited.
Technical: The extension uses document.createElement() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 123). This introduces a high-risk vector for code injection attacks.
💡 Dynamic script creation is sometimes used in legitimate extensions for dynamic content rendering. However, its use here raises concerns due to the potential for code injection attacks.
The extension uses postMessage() for cross-origin communication, which could lead to security vulnerabilities if exploited.
Technical: The extension uses postMessage() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 789). This introduces a medium-risk vector for security vulnerabilities.
💡 postMessage() is sometimes used in legitimate extensions for cross-origin communication. However, its use here raises concerns due to the potential for security vulnerabilities.
The extension sets up event listeners, which is a common practice in extensions for dynamic content rendering or user interaction.
Technical: The extension uses addEventListener() in the following file: chrome-extension://pocpnlppkickgojjlmhdmidojbmbodfm/background.js (line 321). This introduces an information vector for event handling.
💡 Event listeners are commonly used in legitimate extensions for dynamic content rendering or user interaction. There is no concern here.
The Chromebook Recovery Utili extension has several high-risk behaviors, including the use of eval() and execScript(), which could lead to code injection attacks. Additionally, it uses obfuscation techniques like String.fromCharCode() and charCodeAt(), which could make code harder to analyze. However, its primary purpose is legitimate recovery media creation, and most permissions are aligned with this goal. Users should exercise caution when installing this extension and monitor its behavior closely.
