Loom – Screen Recorder Sc

What This Extension Does

The Loom Screen Recorder Sc extension allows users to record their screen and camera with one click, sharing the content instantly via a link. It appears to be designed for productivity and communication purposes.

Permissions Explained

• activeTab: Allows the extension to access the current tab's content.

+ Standard for extensions that need to interact with web pages.

• alarms: Enables the extension to schedule alarms or notifications.

+ Unusual for a screen recording extension, but might be used for reminders or alerts related to recordings.

• contextMenus: Allows the extension to add custom context menu items.

+ Standard for extensions that want to provide additional functionality through menus.

• cookies: Grants access to cookies stored on the user's system.

+ Unusual for a screen recording extension, but might be used to track user interactions or preferences.

• desktopCapture: Enables the extension to capture the user's desktop content.

+ Standard for extensions that need to record the entire screen.

• scripting: Allows the extension to execute scripts in web pages.

+ Unusual for a screen recording extension, but might be used to inject custom functionality into web pages.

• storage: Grants access to local storage on the user's system.

+ Standard for extensions that need to store data locally.

• system.cpu, system.display: Allow the extension to access system information (CPU and display).

+ Unusual for a screen recording extension, but might be used to optimize performance or adjust settings based on system capabilities.

• tabCapture: Enables the extension to capture specific tabs' content.

+ Standard for extensions that need to record web pages.

• webNavigation, webRequest: Allow the extension to intercept and modify web requests.

+ Unusual for a screen recording extension, but might be used to inject custom functionality into web pages or track user interactions.

• <all_urls>: Grants access to all URLs on the internet.

+ Unusual for a screen recording extension, as it implies broad access to user data and browsing history.

• *://.loom.com/: Allows the extension to communicate with Loom's servers.

+ Expected for an extension that needs to share recorded content.

What We Found in the Code

• eval() used: The extension uses eval() to execute arbitrary code, which can pose a security risk if not properly sanitized.

+ Unusual and potentially concerning, especially considering the extension's broad access to user data.

• Makes HTTP requests: The extension makes HTTP requests to various domains, including Loom's servers.

+ Expected for an extension that needs to share recorded content or communicate with its servers.

• Listens to keyboard events: The extension listens to keyboard events, which can be used for shortcuts or custom functionality.

+ Standard for extensions that want to provide additional functionality through keyboard shortcuts.

• Potential data exfiltration pattern: The extension uses a potential data exfiltration pattern, which could be used to steal user data.

+ Unusual and potentially concerning, especially considering the extension's broad access to user data.

External Connections

The extension communicates with various domains, including:

• Loom's servers (www.loom.com, cdn.loom.com, support.loom.com, stage.loom.com)
• GitHub (github.com)
• Amazon S3 (s3.amazonaws.com)
• Segment (api.segment.io)
• Other domains related to productivity and communication tools (e.g., Figma, Google Docs, Slack)

These connections appear expected for an extension that needs to share recorded content or communicate with its servers.

Things to Consider

Based on the extension's purpose and permissions, it appears to have broad access to user data and browsing history. While some permissions are standard for extensions of this type, others (e.g., <all_urls>, cookies) seem unusual and potentially concerning. Users should carefully evaluate whether the extension's benefits outweigh these risks. Additionally, the use of eval() and potential data exfiltration pattern may indicate a higher risk of security vulnerabilities or malicious behavior.