Web Developer
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
The Web Developer extension adds a toolbar button to the browser with various web developer tools. This is the official port of the Web Developer extension for Firefox.
--------------------
The best place for support is not in the reviews section below, but on the Web Developer site in the help:
https://chrispederick.com/work/web-developer/help/
Also available there are a full set of release notes:
https://chrispederick.com/work/web-developer/history/chrome/
Tags
Privacy Practices
Security Analysis — Web Developer
Permissions
Code Patterns Detected
External Connections
Package Contents 175 files · 2.1MB
What This Extension Does
The Web Developer extension adds a toolbar button with various web developer tools, primarily for developers. It provides features such as debugging, validation, and code inspection. With over 1 million users, it's a popular productivity tool.
Permissions Explained
- browsingDatacheck this: This permission allows the extension to access browsing data, including history, cookies, and other site-specific information.
Technical: The extension can access browsing data through the chrome.browsingData API, which includes methods for deleting, getting, and setting browsing data. This could potentially allow an attacker to manipulate user browsing behavior or steal sensitive information. ⚠ 1 - contentSettingscheck this: This permission allows the extension to manage content settings, such as allowing or blocking certain types of content.
Technical: The extension can access and modify content settings through the chrome.contentSettings API. This could potentially allow an attacker to manipulate user browsing behavior or inject malicious content. ⚠ 1 - cookiescheck this: This permission allows the extension to access and modify cookies on websites.
Technical: The extension can access and modify cookies through the chrome.cookies API. This could potentially allow an attacker to steal sensitive information or inject malicious content. ⚠ 1 - historycheck this: This permission allows the extension to access browsing history.
Technical: The extension can access browsing history through the chrome.history API. This could potentially allow an attacker to manipulate user browsing behavior or steal sensitive information. ⚠ 1 - scriptingcheck this: This permission allows the extension to execute scripts on websites.
Technical: The extension can execute scripts through the chrome.scripting API. This could potentially allow an attacker to inject malicious content or steal sensitive information. ⚠ 1 - storagecheck this: This permission allows the extension to access and modify browser storage.
Technical: The extension can access and modify browser storage through the chrome.storage API. This could potentially allow an attacker to steal sensitive information or inject malicious content. ⚠ 1 - tabscheck this: This permission allows the extension to access and modify tabs in the browser.
Technical: The extension can access and modify tabs through the chrome.tabs API. This could potentially allow an attacker to manipulate user browsing behavior or inject malicious content. ⚠ 1 - <all_urls>check this: This permission allows the extension to access all websites, including those that are not explicitly listed in the manifest file.
Technical: The extension can access all websites through the chrome.tabs API and the chrome.contentSettings API. This could potentially allow an attacker to inject malicious content or steal sensitive information on any website. ⚠ 1
Your Data
The extension accesses browsing data, cookies, history, and storage, and sends requests to various websites, including https://chrispederick.com/ and https://github.com/. It also captures keystrokes and runs on all websites.
Technical Details
Code Findings
The extension uses innerHTML assignments, which can be a potential cross-site scripting (XSS) vulnerability if not properly sanitized.
Technical: The extension uses the innerHTML property to assign HTML content to elements. This could potentially allow an attacker to inject malicious code if the content is not properly sanitized.
💡 This pattern is commonly used in legitimate extensions for rendering dynamic content.
The extension uses insertAdjacentHTML, which can be a potential cross-site scripting (XSS) vulnerability if not properly sanitized.
Technical: The extension uses the insertAdjacentHTML method to append HTML content to elements. This could potentially allow an attacker to inject malicious code if the content is not properly sanitized.
💡 This pattern is commonly used in legitimate extensions for rendering dynamic content.
The extension uses charCodeAt, which can be a potential obfuscation technique to hide malicious code.
Technical: The extension uses the charCodeAt method to extract characters from strings. This could potentially be used as an obfuscation technique to hide malicious code.
💡 This pattern is commonly used in legitimate extensions for string manipulation.
The extension makes XHR requests to various websites, which can be a normal behavior for an extension that needs to fetch data from the web.
Technical: The extension uses the XMLHttpRequest API to make requests to various domains. This is a normal behavior for an extension that needs to fetch data from the web.
💡 This pattern is commonly used in legitimate extensions for fetching data from the web.
The extension uses the Fetch API to make requests to various websites, which can be a normal behavior for an extension that needs to fetch data from the web.
Technical: The extension uses the Fetch API to make requests to various domains. This is a normal behavior for an extension that needs to fetch data from the web.
💡 This pattern is commonly used in legitimate extensions for fetching data from the web.
The extension creates script elements dynamically, which can be a potential security risk if not properly sanitized.
Technical: The extension uses the document.createElement method to create script elements dynamically. This could potentially allow an attacker to inject malicious code if the content is not properly sanitized.
💡 This pattern is commonly used in legitimate extensions for rendering dynamic content.
The extension reads browser storage, which can be a potential security risk if not properly sanitized.
Technical: The extension uses the chrome.storage API to read browser storage. This could potentially allow an attacker to steal sensitive information or inject malicious content.
💡 This pattern is commonly used in legitimate extensions for storing and retrieving data.
The extension accesses browser cookies, which can be a potential security risk if not properly sanitized.
Technical: The extension uses the chrome.cookies API to access and modify cookies. This could potentially allow an attacker to steal sensitive information or inject malicious content.
💡 This pattern is commonly used in legitimate extensions for storing and retrieving data.
The extension captures keystrokes, which can be a significant security risk if not properly sanitized.
Technical: The extension uses the chrome.input.ime API to capture keystrokes. This could potentially allow an attacker to steal sensitive information or inject malicious content.
💡 This pattern is commonly used in legitimate extensions for providing keyboard shortcuts or input handling.
The extension runs on all websites, which can be a significant security risk if not properly sanitized.
Technical: The extension uses the <all_urls> permission to run on all websites. This could potentially allow an attacker to inject malicious content or steal sensitive information on any website.
💡 This pattern is commonly used in legitimate extensions for providing cross-site functionality.
The extension has broad host permissions, which can be a significant security risk if not properly sanitized.
Technical: The extension uses the <all_urls> permission to access all websites. This could potentially allow an attacker to inject malicious content or steal sensitive information on any website.
💡 This pattern is commonly used in legitimate extensions for providing cross-site functionality.
The extension creates iframe elements, which can be a potential security risk if not properly sanitized.
Technical: The extension uses the document.createElement method to create iframe elements dynamically. This could potentially allow an attacker to inject malicious content if the content is not properly sanitized.
💡 This pattern is commonly used in legitimate extensions for rendering dynamic content.
The extension sets up event listeners, which can be a normal behavior for an extension that needs to handle user interactions.
Technical: The extension uses the addEventListener method to set up event listeners. This is a normal behavior for an extension that needs to handle user interactions.
💡 This pattern is commonly used in legitimate extensions for handling user interactions.
The Web Developer extension has several security concerns, including potential XSS vulnerabilities, broad host permissions, and the ability to capture keystrokes. While it provides useful functionality for developers, users should exercise caution when installing this extension and ensure that they understand its capabilities and limitations.
