Promethean® Screen Share

What This Extension Does

Permissions Explained

• storage: This permission allows the extension to store data locally on the user's device. For an extension like this, which likely needs to remember screen sharing settings or other user preferences, storage is a standard and expected permission.
• idle: This permission enables the extension to run in the background even when the browser tab is inactive. Given its purpose as a screen sharing tool, it's reasonable that the extension would need to continue running in the background to maintain connections with remote users.
• offscreen: This permission allows the extension to be loaded into an off-screen context, which could be useful for maintaining a connection or handling events even when the user is not actively viewing the browser. While less common than storage and idle permissions, it's still plausible for an extension that needs to maintain continuous connectivity.

What We Found in the Code

• No red-flag code patterns detected: The automated scan did not identify any code patterns that are commonly associated with security vulnerabilities or malicious behavior.
• Content Security Policy (CSP) not set: While not a direct finding from the code, the absence of a CSP is worth noting. A CSP helps protect against cross-site scripting (XSS) attacks by specifying which sources of content are allowed to be executed within a web page. For an extension that handles user input and potentially shares screens with others, implementing a CSP would be a good practice for enhancing security.

External Connections

• www.w3.org: A standard domain for accessing World Wide Web Consortium resources.
• momentjs.com, formatjs.io, github.com, reactjs.org, and mui.com: These are libraries or frameworks commonly used in web development, suggesting the extension uses them for functionality like date formatting, UI components, etc.
• support.prometheanworld.com and servicediscovery.mypromethean.com: These domains seem related to the Promethean service itself, possibly for authentication, configuration, or other settings management.
• api.servicediscovery.mypromethean.com: This suggests interaction with an API for accessing services or data from Promethean.
• fb.me and apps.apple.com: These are less directly related to the extension's functionality but could be used for sharing links or providing download instructions, respectively.
• bugs.webkit.org: A domain for reporting bugs in WebKit, which is a browser engine. This might indicate the developers use this resource for debugging their extension.

Things to Consider