Google Scholar Button
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Lets you quickly look up scholarly articles as you browse the web, directly from your browser's address bar or search results. Perfect for researchers, students, and anyone needing to verify information on academic papers. Benefits most those who frequently need to cite sources or find relevant studies in their field of study.
Overview
This extension adds a browser button for easy access to Google Scholar from any web page. Click the Scholar button to:
- Find full text on the web or in your university library. Select the title of the paper on the page you're reading, and click the Scholar button to find it.
- Transfer your query from web search to Scholar. Press the Scholar button to see top three results; click "full screen" at the bottom of the popup to see them all.
- Format references in widely used citation styles. Press the quote button below the result to see a formatted reference and copy it into the paper you're writing.
- Save the article to your Scholar library, so you can read it or cite it later. Press the blue star below the result to save it, or the gray star at the bottom to see all saved articles.
Library links work best when you're on campus. To configure them for off-campus use, visit Google Scholar Settings at https://scholar.google.com/scholar_settings (you may need to login with your library password or to set up your browser to use a library proxy; please visit your library's website or ask a local librarian for assistance).
To search the US case law, click the gear icon at the bottom of the popup, and configure your preferred collection in Google Scholar Settings.
By installing this extension, you agree to the Google Terms of Service and Privacy Policy at https://www.google.com/intl/en/policies/.
Tags
Privacy Practices
Security Analysis — Google Scholar Button
Permissions
Code Patterns Detected
External Connections
Package Contents 62 files · 105KB
What This Extension Does
The Google Scholar Button extension adds a browser button for easy access to Google Scholar from any web page, allowing users to find full text articles, transfer queries, format references, and save articles to their library. This extension is suitable for academics, researchers, and students who frequently use Google Scholar. With over 3 million users, it's essential to evaluate its security posture.
Permissions Explained
- storageexpected: This permission allows the extension to store data locally on your device, such as saved articles and library settings.
Technical: The extension uses Chrome's storage API to access local storage, which can be accessed by other extensions or malicious scripts if compromised. This exposes sensitive user data, including library credentials and saved article metadata. - activeTabexpected: This permission enables the extension to access the currently active tab's content, allowing it to perform actions like transferring queries or formatting references.
Technical: The extension uses Chrome's tabs API to access the active tab's content, which can be used to inject malicious scripts or steal sensitive information if compromised. This exposes user browsing data and potentially sensitive information. - scriptingexpected: This permission allows the extension to execute scripts in the context of web pages, enabling features like formatting references or saving articles.
Technical: The extension uses Chrome's content script injection API to inject scripts into web pages, which can be used to inject malicious code or steal sensitive information if compromised. This exposes user browsing data and potentially sensitive information. - *://scholar.google.com/*expected: This permission enables the extension to access Google Scholar's services, including searching for articles and saving them to your library.
Technical: The extension uses a wildcard permission to access all subdomains of scholar.google.com, which can be used to inject malicious scripts or steal sensitive information if compromised. This exposes user browsing data and potentially sensitive information.
Your Data
The extension accesses local storage on your device, including library credentials and saved article metadata. It also sends requests to Google Scholar's services, including searching for articles and saving them to your library.
Technical Details
- scholar.google.com
- lh3.googleusercontent.com
- accounts.google.com
- HTTPS
- cookies
- tokens
- page content
Code Findings
The extension uses innerHTML to inject scripts into web pages, which can be used by attackers to inject malicious code or steal sensitive information.
Technical: The extension's content script injects a script that sets the innerHTML of an element to a user-provided value. This can lead to XSS attacks if the user-provided value is not properly sanitized.
💡 This pattern is commonly used in legitimate extensions to inject scripts into web pages, but it requires proper sanitization and validation to prevent XSS attacks.
The extension uses charCodeAt to obfuscate its code, making it harder for users to understand what the extension is doing.
Technical: The extension's JavaScript files use charCodeAt to encode strings, which can make it difficult for security analysts to review and analyze the code.
💡 This pattern is commonly used in legitimate extensions to obfuscate code, but it can also be used by attackers to hide malicious behavior.
The extension makes HTTP requests to Google Scholar's services, which is a normal behavior for this type of extension.
Technical: The extension uses the XMLHttpRequest API to make GET and POST requests to Google Scholar's services.
💡 This pattern is commonly used in legitimate extensions to access web services and APIs.
The extension uses postMessage to communicate with other scripts across different origins, which can be used by attackers to inject malicious code or steal sensitive information.
Technical: The extension's content script uses postMessage to send and receive messages with other scripts across different origins.
💡 This pattern is commonly used in legitimate extensions to communicate with other scripts across different origins, but it requires proper validation and sanitization to prevent XSS attacks.
The extension sets up event listeners to respond to user interactions, which is a normal behavior for this type of extension.
Technical: The extension's content script sets up event listeners using the addEventListener API.
💡 This pattern is commonly used in legitimate extensions to respond to user interactions.
Overall, the Google Scholar Button extension has a moderate security posture. While it uses some potentially insecure patterns like innerHTML assignment and charCodeAt obfuscation, these are not critical vulnerabilities. However, users should be aware of the potential risks associated with these patterns and take necessary precautions to protect their sensitive information.
