Endpoint Verification
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
By installing this item, you agree to the Google Terms of Service and Privacy Policy at https://www.google.com/intl/en/policies/.
For more information: https://support.google.com/a/users/answer/9018161
Tags
Privacy Practices
Security Analysis — Endpoint Verification
Permissions
Code Patterns Detected
External Connections
Package Contents 38 files · 2.9MB
What This Extension Does
The Endpoint Verification extension allows Google Workspace administrators to view laptop and desktop status, including OS, device, and user information. It's designed for productivity and workflow management. With over 7 million users, it's a popular choice among administrators.
Permissions Explained
- cookiesexpected: This permission allows the extension to read cookies from your browser.
Technical: The extension can access cookies using the chrome.cookies API, which grants access to all cookies on the domain. This could potentially allow unauthorized access to sensitive data if compromised. - idleexpected: This permission allows the extension to monitor your device's idle state.
Technical: The extension can use the chrome.idle API to detect when you're away from your device, which could be used for tracking or monitoring purposes if compromised. - nativeMessagingcheck this: This permission allows the extension to communicate with native applications on your device.
Technical: The extension can use native messaging to exchange data between Chrome and native apps, which could potentially allow unauthorized access to sensitive data if compromised. This is a CRITICAL risk due to its potential for lateral movement. ⚠ 1 - storageexpected: This permission allows the extension to store data locally on your device.
Technical: The extension can use the chrome.storage API to store and retrieve data, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - alarmsexpected: This permission allows the extension to schedule alarms and notifications on your device.
Technical: The extension can use the chrome.alarms API to schedule events, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - enterprise.deviceAttributesexpected: This permission allows the extension to access device attributes, such as OS and device information.
Technical: The extension can use the chrome.enterprise.deviceAttributes API to access device metadata, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - enterprise.platformKeysexpected: This permission allows the extension to access platform keys, which are used for encryption and decryption.
Technical: The extension can use the chrome.enterprise.platformKeys API to access platform keys, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - gcmexpected: This permission allows the extension to use Google Cloud Messaging (GCM) services.
Technical: The extension can use GCM to send and receive messages, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - identityexpected: This permission allows the extension to access user identity information, such as email addresses and profiles.
Technical: The extension can use the chrome.identity API to access user metadata, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - identity.emailexpected: This permission allows the extension to access user email addresses.
Technical: The extension can use the chrome.identity API to access user email addresses, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - platformKeysexpected: This permission allows the extension to access platform keys, which are used for encryption and decryption.
Technical: The extension can use the chrome.platformKeys API to access platform keys, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - enterprise.reportingPrivateexpected: This permission allows the extension to access private reporting features.
Technical: The extension can use the chrome.enterprise.reportingPrivate API to access private reporting features, which could potentially allow unauthorized access to sensitive data if compromised. This is a MEDIUM risk due to its potential for data exposure. - *://*.google.com/*check this: This permission allows the extension to communicate with Google services.
Technical: The extension can use this permission to access various Google APIs, which could potentially allow unauthorized access to sensitive data if compromised. This is a HIGH risk due to its potential for lateral movement and data exposure. ⚠ 1
Your Data
The extension accesses device attributes, user identity information, and platform keys, which could potentially allow unauthorized access to sensitive data if compromised. It also communicates with various Google services, including GCM.
Technical Details
Code Findings
The extension assigns innerHTML values dynamically, which could potentially allow cross-site scripting (XSS) attacks if compromised.
Technical: The extension uses the following code pattern: element.innerHTML = value;. This is a common pattern for XSS vectors and should be reviewed carefully to ensure it's not exploitable.
💡 This pattern is commonly used in legitimate extensions to dynamically update content. However, it requires careful handling of user input to prevent XSS attacks.
The extension captures keystrokes, which could potentially allow unauthorized access to sensitive data if compromised.
Technical: The extension uses the following code pattern: chrome.commands.onCommand.addListener(function(command) { ... });. This is a common pattern for capturing user input and should be reviewed carefully to ensure it's not exploitable.
💡 This pattern is commonly used in legitimate extensions to capture user input. However, it requires careful handling of sensitive data to prevent unauthorized access.
The extension uses postMessage for cross-origin communication, which could potentially allow unauthorized access to sensitive data if compromised.
Technical: The extension uses the following code pattern: window.postMessage(message);. This is a common pattern for cross-origin communication and should be reviewed carefully to ensure it's not exploitable.
💡 This pattern is commonly used in legitimate extensions to communicate with other origins. However, it requires careful handling of sensitive data to prevent unauthorized access.
The Endpoint Verification extension has several security concerns that should be addressed by the developer. The nativeMessaging permission poses a CRITICAL risk due to its potential for lateral movement and data exposure. Additionally, the extension captures keystrokes, which could potentially allow unauthorized access to sensitive data if compromised. We recommend that users exercise caution when installing this extension and carefully review its permissions and behavior.
