Stacker - Falling blocks!

What This Extension Does

Stacker - Falling blocks! is a Chrome extension categorized as a game, which plays in a popup. It allows users to stack falling tetra blocks without hitting the ceiling.

Permissions Explained

• storage: This permission allows the extension to store and retrieve data locally on the user's device. For a game like Stacker, this is likely used to save progress or settings.

- Standard for games that require persistence.

What We Found in the Code

• [medium] innerHTML assignment — potential XSS vector: The extension uses innerHTML to update its UI. While this can be a legitimate way to render dynamic content, it does introduce some risk if untrusted data is used. However, without more context, it's difficult to say whether this is an issue.

- Normal coding pattern for UI rendering; potential concern if untrusted data is involved.

• [info] Makes HTTP requests: The extension makes external requests, which could be for API calls or other purposes. This is a normal part of many extensions and web applications.

- Expected behavior for extensions that need to fetch resources or send data.

• [high] Listens to keyboard events: The extension listens for keyboard events, which might be used for shortcuts or other interactive features. However, this could also be an unusual pattern if it's not necessary for the game's functionality.

- Unusual without more context; could be a legitimate use for shortcuts or UI interaction.

External Connections

• www.google-analytics.com: This is likely used for analytics tracking to understand user behavior and improve the extension.
• k-ext.pages.dev, k-ext-ads.netlify.app: These domains are less clear but might be related to advertising or other monetization strategies. Their presence could raise questions about data collection and privacy.
• forms.gle: This is a Google Forms link, which might be used for user feedback or surveys.

Things to Consider

• The extension's permissions seem generally aligned with its purpose as a game that requires storage for progress and possibly external resources for functionality. However, the use of keyboard listeners without more context could raise questions about how it interacts with the user.
• Users should consider whether they are comfortable with the potential data collection implied by the external domains referenced, especially if these are related to advertising or analytics.
• The lack of a Content Security Policy (CSP) might make the extension more vulnerable to certain types of attacks. However, this is not unique to Stacker and is a common oversight in many extensions.