Security Alert: Confirmed Malware
This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Amazon Assistant for Chrome
CRITICAL RISKRemoved from Chrome Web Store
Amazon Assistant for Chrome
ID: pbjikboenpfhbbejgkoklgkhjpfogcam
Could be malicious
Supported Languages
🇧🇷Brazilian Portuguese
🇬🇧British English
🇨🇳Chinese (Simplified)
🇺🇸English
🇫🇷French
🇩🇪German
🇮🇹Italian
🇯🇵Japanese
🇲🇽Latin American Spanish
🇪🇸Spanish
🇹🇷Turkish
🇺🇸US English
Extension Info & Metadata
Status
Removed
Version
10.2303.29.10312
Size
0.51 MB
Rating
3.6/5
Reviews
3,460
Users
8,250,017
Type
Extension
Updated
Apr 28, 2023
Category
12_shopping
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Publisher Contextual Analysis
Trusted
- Author
- https://amazon.comView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 410 Terry Ave N Seattle, WA 98109-5210 US
- Website
- Visit
Total Extensions
3
Active
0
Obsolete
2
Listed
2
Unlisted
1
Total Users
8,670,017
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Amazon's official browser extension. By installing you agree to the Conditions of Use at amazon.co.uk/aa/TOU
Amazon's official browser extension. By installing you agree to the Conditions of Use at amazon.com/aa/TOU At Amazon, we’re always experimenting and evaluating the potential of our products. We have made the decision to discontinue Amazon Assistant as of March 28, 2023. From that date you will no longer be able to use Amazon Assistant. You will still have access on Amazon to Lists you’ve already created with Amazon Assistant, and the products you previously added from other sites will remain. We apologize for any inconvenience this decision may cause you.
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical31
High94
Medium25
Low2
Versions scanned
Showing 6 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 10.2303.29.10312 | 5 |
| 10.2102.26.11554 | 28 |
| 10.2101.20.12151 | 40 |
| 10.2012.22.11753 | 46 |
| 10.2009.18.12123 | 23 |
| 10.2008.6.11904 | 10 |
Files with findings
31 distinct paths — top paths by unique finding count:
- js/Extension.built.min.js35
- js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js12
- js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js9
- js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js9
- static/html/InternetExplorerPanel.html8
- js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js7
- js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js6
- js/ubp/extension/contextual/peer-scripts/libraries/MetaDataLibrary.js5
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Code Injection | critical | static/html/firefoxContainer.html (line 31) | The 'processUrl' query parameter is extracted from the page URL and directly assigned to an iframe's src attribute without any validation or allowlisting. An attacker who can control the URL navigated to can load arbi… | |
| 2 | Code Injection | critical | js/Extension.built.min.js (line 75) | The RequireJS loader exposes a req.exec function that directly calls eval() on arbitrary text strings. Combined with the dynamic gateway URL update mechanism and remote configuration loading from S3, this creates a fu… | |
| 3 | Code Injection | critical | static/html/firefoxContainer.html (line 31) | The firefoxContainer.html page sets an iframe's src directly from a URL query parameter (processUrl) without any validation or origin allowlisting. This is an open redirect/iframe injection vulnerability — an attacker… | |
| 4 | Code Injection | critical | js/Extension.built.min.js (line 75) | The extension uses eval() via the RequireJS req.exec shim to execute dynamically loaded module text. This means any JavaScript text fetched from remote S3 endpoints (such as FeatureManifest.js or logging-config.js) is… | |
| 5 | Code Injection | critical | static/html/firefoxContainer.html (line 21) | The firefoxContainer.html page reads a URL from the query parameter 'processUrl' and directly assigns it as the src of an iframe without any validation or allowlisting. This allows any caller to inject an arbitrary UR… | |
| 6 | Credential Theft | critical | js/Extension.built.min.js (line 75) | The extension uses the chrome.cookies API to read cookie names, domains, values, paths, and expiration dates for specified URLs, and exposes this capability via getCookieInfo and bulkGetCookieInfo APIs to all loaded r… | |
| 7 | Credential Theft | critical | static/js/cookieProxy.js (line 1) | The CookieProxy receives cookie data keyed as 'CookieData' via postMessage (with no origin validation), appends all cookie key-value pairs as URL query parameters, then loads that URL into a frame via updateFrameSourc… | |
| 8 | Credential Theft | critical | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 86) | The input and keydown instrumentors allow the extension background to programmatically set the value property of any input element on the page and dispatch synthetic input and keydown events, indistinguishable from re… | |
| 9 | Credential Theft | critical | static/js/cookieProxy.js (line 1) | The CookieProxy listens for postMessages containing 'CookieData' payloads, iterates over all cookie key-value pairs, URL-encodes them, and appends them to a target URL before loading that URL in a sandboxed iframe. Th… | |
| 10 | Credential Theft | critical | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 80) | The `input` and `keydown` methods allow programmatic injection of arbitrary values into any DOM input element (selected by CSS selector) and simulation of keyboard events, all driven by server-supplied selectors and v… | |
| 11 | Data Exfiltration | critical | js/Extension.built.min.js (line 86) | The 'Titan' and 'TitanClient' processes have API access to scrape, listenerSpecificationScrape, getPageLocationData, getPageReferrer, getPagePerformanceTimingData, and appendMetricData. The scrape API combined with in… | |
| 12 | Network Interception | critical | js/Extension.built.min.js (line 75) | The extension registers webRequest listeners with requestBody, requestHeaders, and responseHeaders access for URL patterns loaded from remote configuration. This grants the extension access to full HTTP request bodies… | |
| 13 | Network Interception | critical | js/Extension.built.min.js (line 79) | The Platform process registers listeners for WebRequest.onBeforeRequest, WebRequest.onBeforeSendHeaders, and WebRequest.onCompleted, giving it visibility into all browser network traffic. It also exposes scrape, getPa… | |
| 14 | Network Interception | critical | js/Extension.built.min.js (line 91) | The extension registers webRequest listeners for onBeforeRequest (capturing requestBody), onBeforeSendHeaders (capturing requestHeaders), and onCompleted (capturing responseHeaders) against dynamically configured trac… | |
| 15 | Privilege Escalation | critical | js/Extension.built.min.js (line 86) | An 'Integration' process module is configured to load its HTML from an S3 QA automation bucket (aa-qa-automation.s3.amazonaws.com/integration.html) and is granted an extraordinarily broad set of platform capabilities … | |
| 16 | Remote Code Loading | critical | js/Extension.built.min.js (line 75) | The extension periodically fetches remote FeatureManifest.js files from per-locale Amazon S3 buckets on a polling loop, and the requirejs module loader has an exec() method that calls eval() directly to execute dynami… | |
| 17 | Remote Code Loading | critical | static/js/loadCachedGateway.js (line 1) | This script reads a URL from localStorage under the key 'UBPv2GatewayURL' and sets it as the src of the main extension panel iframe without any validation of the URL's origin or safety. If an attacker can write to loc… | |
| 18 | Remote Code Loading | critical | js/Extension.built.min.js (line 79) | The TitanClient process is loaded from an external Amazon proxy server at runtime rather than being bundled with the extension. It consumes sensitive platform APIs including scrape, getPageLocationData, getPageReferre… | |
| 19 | Remote Code Loading | critical | js/Extension.built.min.js (line 86) | The extension fetches a remote JavaScript file (FeatureManifest.js) from per-locale S3 buckets and executes it via req.exec()/eval(). This constitutes a remote code loading pattern: the extension's behavior can be rem… | |
| 20 | Remote Code Loading | critical | js/Extension.built.min.js (line 85) | Each locale has a remoteConfigurationEndpoint pointing to a .js file on S3 (e.g., logging-config.js) that is fetched and merged into the live configuration. The fetched content from these endpoints can alter operation… | |
| 21 | Remote Code Loading | critical | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 306) | IFrameCreationStrategy injects hidden iframes into the page by attaching them inside closed Shadow DOM roots (mode: 'closed', preventing inspection). The iframe src is a proxyUrl supplied at runtime by the extension b… | |
| 22 | Remote Code Loading | critical | static/js/loadCachedGateway.js (line 1) | The extension reads a URL string (`UBPv2GatewayURL`) from localStorage and directly assigns it as the `src` of the main panel iframe with no validation or sanitization. If an attacker can write to this extension's loc… | |
| 23 | Tracking | critical | js/Extension.built.min.js (line 79) | The Reporter process aggregates customer identity tokens (getInstallationId, getInstallationToken, getCustomerToken) with Titan-collected browsing telemetry (scrape, getPageReferrer, getPageLocationData, getPagePerfor… | |
| 24 | Unauthorized Data Collection | critical | js/Extension.built.min.js (line 75) | The extension implements a cookie synchronization service that reads Amazon session cookies (session-id, customer-id 'x-main', and 'ubid-main') and transmits them to cookie.browserapps.amazon.com via a CookieInstallSe… | |
| 25 | Unauthorized Data Collection | critical | js/Extension.built.min.js (line 75) | The extension exposes customer authentication tokens (getCustomerToken), unique installation identifiers (getInstallationId, getInstallationToken), and A/B test treatment data (getAllWeblabTreatments) to all remote-lo… | |
| 26 | Unauthorized Data Collection | critical | js/Extension.built.min.js (line 75) | The extension background exposes a comprehensive page surveillance API set to all remote-loaded processes: page referrer URLs (browsing history), full current URL and path (browsing behavior), performance timing, view… | |
| 27 | Unauthorized Data Collection | critical | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 53) | WebpageInstrumentLibrary provides remote-controlled DOM interaction: programmatically click arbitrary elements, inject values into form fields by setting element.value and dispatching synthetic input events, and simul… | |
| 28 | Unauthorized Data Collection | critical | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 76) | The Scraper class implements a full multi-strategy DOM extraction engine (CSS selectors, XPath, URL regex, metatag, full-text regex) driven by runtime-supplied specifications received from the extension backend. This … | |
| 29 | Unauthorized Data Collection | critical | js/ubp/extension/contextual/peer-scripts/drivers/chrome/ScrapeDriver.js (line 4) | This driver registers a chrome.runtime.onMessage listener that delegates arbitrary scraping operations to ScrapeLibrary.Scraper — a library initialized with the full document of the Amazon page. The extension backgrou… | |
| 30 | Unauthorized Data Collection | critical | js/ubp/extension/contextual/peer-scripts/drivers/chrome/MetaDataDriver.js (line 4) | This driver initializes MetaDataLibrary.MetaData with the full window object of the Amazon page and registers an extension message listener that can invoke any handler supported by the MetaData library. Passing the en… | |
| 31 | Unauthorized Data Collection | critical | js/ubp/extension/contextual/peer-scripts/drivers/chrome/ActionDriver.js (line 4) | The ActionDriver initializes Action.ActionLibrary with the full document of the Amazon page and a callback that sends any action result to the extension background. The extension background can remotely command this d… | |
| 32 | Code Injection | high | static/html/InternetExplorerPanel.html (line 414) | The IE panel has the same unvalidated postMessage handler that writes a supplied gatewayURL to localStorage, plus an additional XSS vector: the extensionLogId value received from the unvalidated postMessage is injecte… | |
| 33 | Code Injection | high | static/html/InternetExplorerPanel.html (line 583) | The extensionLogId variable, populated from untrusted postMessage data with no origin validation, is written directly into innerHTML. Since the message listener accepts messages from any origin, a malicious page can s… | |
| 34 | Code Injection | high | static/html/safariPanel.html (line 217) | The extensionLogId sourced from untrusted postMessage data with no origin validation is written directly to innerHTML, creating the same XSS vector present in InternetExplorerPanel.html. Any page can send a crafted me… | |
| 35 | Code Injection | high | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 265) | The sandbox creation mechanism clones existing DOM nodes, strips their identifiers, attaches a closed Shadow DOM to hide the injected content from page scripts, and injects a backend-controlled URL into a hidden zero-… | |
| 36 | Code Injection | high | js/Extension.built.min.js (line 78) | The extension constructs functions at runtime using new Function(...) with dynamically assembled string arguments — a form of dynamic code generation equivalent to eval. This pattern is used in the Bluebird promise li… | |
| 37 | Code Injection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/InlineWidgetDriver.js (line 4) | The InlineWidgetDriver wires InlineWidgetLibrary.InlineWidgetHandler to the extension's runtime message bus, allowing the extension background to remotely command the injection of inline widgets (rendered HTML/JS elem… | |
| 38 | Code Injection | high | static/html/panel.html (line 20) | The main panel page loads loadCachedGateway.js which reads a gateway URL from localStorage and injects it as the iframe src. Given the postMessage handlers in other panel pages allow unauthenticated gatewayURL writes … | |
| 39 | Code Injection | high | static/html/firefoxPanel.html (line 97) | The Firefox panel's postMessage handler accepts gateway URL updates from any message sender (no origin check on msgEvent.origin) and stores the value directly in localStorage. This allows any web page or iframe to inj… | |
| 40 | Code Injection | high | static/html/InternetExplorerPanel.html (line 413) | The IE panel's postMessage handler receives a gatewayURL from messages and writes it directly to localStorage without any origin validation on the message source. An attacker-controlled page or script could send a cra… | |
| 41 | Code Injection | high | static/html/InternetExplorerPanel.html (line 489) | Translation strings are written directly to DOM elements using `innerHTML` instead of `textContent`. If any translation string or the locale loading mechanism (which uses XMLHttpRequest) is compromised or tampered wit… | |
| 42 | Credential Theft | high | static/html/cookieProxy.html (line 55) | cookieProxy.html is a web_accessible_resource that any external web page can load. It bridges cookie data between web page contexts and the extension via postMessage, using baseProxy.js to relay messages with a wildca… | |
| 43 | Credential Theft | high | static/js/cookieProxy.js (line 1) | cookieProxy.js receives cookie data via postMessage and URL-encodes it as query parameters appended to a target URL before loading it in an iframe. Cookie key-value pairs are serialized into a URL query string and pas… | |
| 44 | Credential Theft | high | static/html/cookieProxy.html (line 55) | This page is a web-accessible resource that loads cookie proxying scripts alongside an unsandboxed iframe. Combined with the cookieProxy.js logic that harvests cookie key-value pairs and appends them to URLs loaded in… | |
| 45 | Credential Theft | high | js/Extension.built.min.js (line 82) | The extension directly reads amazon.com's localStorage (getFromAmazonLocalStorage) from within the extension context, bypassing the same-origin policy that would normally prevent cross-origin localStorage access. This… | |
| 46 | Credential Theft | high | static/html/cookieProxy.html (line 55) | This page is explicitly named cookieProxy.html and loads a script called cookieProxy.js alongside baseProxy.js, indicating it functions as a proxy for cookie access. Given the extension's broad cookie permissions cove… | |
| 47 | Data Exfiltration | high | static/js/cookieProxy.js (line 1) | This proxy waits for a message containing `CookieData`, appends every returned cookie key/value into the target URL query string, and then loads that URL in an iframe. Passing cookie material through URL parameters is… | |
| 48 | Data Exfiltration | high | static/js/baseProxy.js (line 1) | The wireEvents function relays all postMessage traffic bidirectionally between the parent window and a sandboxed iframe using wildcard origin ('*') in both directions, eliminating origin validation entirely. Any windo… | |
| 49 | Data Exfiltration | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 271) | TextJsRegexEvaluator constructs regex objects from backend-supplied patterns and applies them against every text node in the document subtree, enabling targeted extraction of any text content — including prices, email… | |
| 50 | Data Exfiltration | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 133) | UrlJsRegexEvaluator constructs regex from backend-supplied patterns and applies them to the full current page URL, then extracts and returns matched content. This allows the backend to selectively harvest URL fragment… | |
| 51 | Data Exfiltration | high | js/Extension.built.min.js (line 86) | The extension sends postMessage with a wildcard target origin '*' and accepts inbound messages from wildcard origins. This means messages containing identity tokens, customer data, and platform commands can be receive… | |
| 52 | Data Exfiltration | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js (line 7) | This content script creates a bidirectional message relay between the extension background and the host page: it forwards all extension runtime messages into the page context via window.parent.postMessage(request, '*'… | |
| 53 | Data Exfiltration | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/SandboxDriver.js (line 55) | The SandboxDriver installs a SandboxLibrary.Sandboxer instance on window._chromeSandboxLibrary and registers both an extension onMessage listener and a window.addEventListener('message', ...) listener. The window mess… | |
| 54 | Data Exfiltration | high | static/js/cookieProxy.js (line 1) | The wireEvents function relays all messages from an embedded iframe's contentWindow back to window.parent using a wildcard '*' targetOrigin. Using '*' in postMessage means any origin can receive the relayed messages, … | |
| 55 | Data Exfiltration | high | js/Extension.built.min.js (line 74) | The extension implements a 'SyncCookie' module that actively collects Amazon session cookies and transmits them to remote endpoints (e.g., `cookie.browserapps.amazon.com`) every 2,000 milliseconds (syncInterval:2e3) a… | |
| 56 | Network Interception | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js (line 7) | This content script (injected at document_start on all Amazon domains) creates a bidirectional message bridge between the extension background and the Amazon page. Extension messages are forwarded to window.parent wit… | |
| 57 | Network Interception | high | static/html/InternetExplorerPanel.html (line 414) | The message event listener has no origin validation, allowing any page to inject a gatewayURL value into localStorage which will then be loaded as the iframe src on subsequent panel opens. Additionally, extensionId va… | |
| 58 | Network Interception | high | static/html/firefoxPanel.html (line 97) | Same unvalidated postMessage listener pattern as InternetExplorerPanel.html: any origin can inject an arbitrary gatewayURL into localStorage, which is then loaded as the extension panel iframe's src, enabling remote U… | |
| 59 | Network Interception | high | static/html/safariPanel.html (line 81) | No origin validation on the Safari panel message listener; any origin can set extensionLogId (later injected into innerHTML for XSS) or override the stored gatewayURL in localStorage. The gateway URL will be loaded as… | |
| 60 | Network Interception | high | static/js/baseProxy.js (line 1) | BaseProxy forwards all messages bidirectionally between parent and embedded iframe with wildcard '*' targetOrigin in both directions. The target URL is parsed from query parameters, and the allowedHostNames regex patt… | |
| 61 | Network Interception | high | js/Extension.built.min.js (line 74) | The extension registers `webRequest` listeners that intercept HTTP requests with full access to `requestBody` (POST data including potentially passwords or payment details), `requestHeaders` (authorization tokens, coo… | |
| 62 | Obfuscation | high | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 328) | This code hides an iframe inside a closed shadow root, assigns it a randomized class name, and loads a caller-supplied `proxyUrl`. That combination is suspicious because it makes the injected frame hard to inspect or … | |
| 63 | Obfuscation | high | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 265) | The SandboxLibrary injects hidden iframes into the host page using closed Shadow DOM (mode: 'closed') to conceal them from page inspection tools. Iframes are attached to randomly-selected and cloned DOM elements with … | |
| 64 | Obfuscation | high | static/html/InternetExplorerPanel.html (line 710) | Core panel logic is loaded from a local DLL resource using the IE-specific 'res://' protocol, which loads JavaScript from opaque binary DLL resources embedded on disk. This technique makes the actual payload completel… | |
| 65 | Obfuscation | high | static/html/InternetExplorerExtension.html (line 32) | The extension background script itself is loaded from a compiled DLL binary ('aaResources.dll') using the IE res:// protocol, hiding the entire background logic from extension static analysis. This means the actual ex… | |
| 66 | Obfuscation | high | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 265) | The iframe injection strategy deliberately selects a random existing page element (div or span), clones it, strips all identifying attributes, assigns a randomly generated class name, and uses it as the shadow root ho… | |
| 67 | Obfuscation | high | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 257) | The IFrameCreationStrategy injects hidden iframes into host pages using a deliberately evasive technique: it clones a random existing DOM element, strips all identifying attributes, generates a random UUID-based class… | |
| 68 | Privilege Escalation | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js (line 4) | This content script bridges messages between the web page and the extension in both directions, but uses `postMessage(..., "*")` and does not verify `event.origin`. Any script running in the matched page can therefore… | |
| 69 | Privilege Escalation | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/SandboxDriver.js (line 50) | The SandboxDriver attaches a window message listener that routes all page-level postMessages without origin or type filtering directly into the SandboxLibrary's sandboxMessageHandler. Any script on the page can post m… | |
| 70 | Privilege Escalation | high | static/js/performanceMessaging.js (line 1) | This script listens to all window postMessage events and forwards any message with a numeric 'performanceType' field directly to the extension background via chrome.runtime.sendMessage, without validating the message … | |
| 71 | Privilege Escalation | high | static/js/performanceMessaging.js (line 1) | This script forwards any window message with a numeric 'performanceType' property directly to chrome.runtime.sendMessage without any origin validation on the incoming postMessage. Any web page can craft a message with… | |
| 72 | Privilege Escalation | high | static/js/baseProxy.js (line 1) | The allowedHostNames patterns use unanchored regex matching via String.search() rather than strict hostname equality checks. The pattern '(browserapp).*(amazon)' could match attacker-controlled domains such as 'browse… | |
| 73 | Privilege Escalation | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js (line 7) | This content script (run_at document_start on all Amazon pages) forwards all extension runtime messages to the page via postMessage with wildcard target origin '*', leaking internal extension communications to any lis… | |
| 74 | Privilege Escalation | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/SandboxDriver.js (line 54) | SandboxDriver attaches a global window message listener with no origin validation that passes all incoming messages directly to the sandbox library handler, which relays results to the extension background via runtime… | |
| 75 | Privilege Escalation | high | static/js/performanceMessaging.js (line 1) | This script listens for all window messages and forwards any message that has a numeric 'performanceType' property directly to chrome.runtime.sendMessage without sanitizing the payload or verifying the message source … | |
| 76 | Privilege Escalation | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js (line 8) | The driver forwards all extension runtime messages to the parent frame via postMessage with a wildcard origin ('*'), meaning any page can receive the forwarded messages regardless of origin. It also listens for messag… | |
| 77 | Privilege Escalation | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/SandboxDriver.js (line 50) | The SandboxDriver attaches a global _chromeSandboxLibrary property directly to the window object and registers a message event listener that passes all window messages through to the sandbox library's handler without … | |
| 78 | Privilege Escalation | high | static/js/performanceMessaging.js (line 1) | This script listens for all window message events and forwards any message containing a numeric `performanceType` field directly to the extension's background script via `chrome.runtime.sendMessage`, without validatin… | |
| 79 | Privilege Escalation | high | static/html/aaLoader.html (line 103) | Two iframes are loaded with the `application="yes"` attribute and res:// DLL resource URLs. The `application` attribute in IE's HTA context grants the iframe script full access to the parent frame and bypasses same-or… | |
| 80 | Remote Code Loading | high | static/html/firefoxPanel.html (line 97) | The postMessage handler accepts messages from any origin (no check on msgEvent.origin) and writes an attacker-supplied gatewayURL directly to localStorage under the key 'UBPv2GatewayURL'. Any web page that can send a … | |
| 81 | Remote Code Loading | high | static/html/firefoxContainer.html (line 31) | firefoxContainer.html reads the 'processUrl' query parameter from its own URL and assigns it directly to an iframe's src attribute with no URL scheme or hostname validation. Since this file is loaded by the extension,… | |
| 82 | Remote Code Loading | high | static/js/loadCachedGateway.js (line 1) | This script reads a gateway URL from localStorage (key 'UBPv2GatewayURL') and directly sets it as the src of the main extension panel iframe with no URL validation. The localProxy.html web_accessible_resource allows e… | |
| 83 | Remote Code Loading | high | js/Extension.built.min.js (line 85) | The extension fetches operational configuration from a remote S3 endpoint (ubp-common-us-prod.s3.amazonaws.com/logging/logging-config.js) and can dynamically update its primary gateway URL at runtime via _setNewGatewa… | |
| 84 | Remote Code Loading | high | js/Panel.built.min.js (line 82) | The panel component dynamically updates the iframe src based on a gateway URL received from the extension background, and can also force a full extension reload via _handleReloadExtensionMessage. This mechanism allows… | |
| 85 | Remote Code Loading | high | js/Extension.built.min.js (line 75) | The RequireJS loader dynamically creates script elements and injects them into the DOM to load modules. When combined with the remote S3 module endpoints (FeatureManifest.js, logging-config.js), this creates a pipelin… | |
| 86 | Remote Code Loading | high | static/js/loadCachedGateway.js (line 1) | This script reads a gateway URL from localStorage under the key 'UBPv2GatewayURL' and loads it into the main panel iframe without any origin validation or URL sanitization. If an attacker or a prior network response c… | |
| 87 | Remote Code Loading | high | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 364) | The sendMessageToSandbox method calls postMessage(message, '*') with a wildcard origin, sending arbitrary messages from the extension's content script to the injected iframe without restricting the target origin. This… | |
| 88 | Remote Code Loading | high | static/html/InternetExplorerPanel.html (line 414) | The receiveMessage handler accepts postMessages from any origin (msgEvent.origin is never checked) and writes the gatewayURL from the message payload directly into localStorage. A malicious page that can postMessage t… | |
| 89 | Remote Code Loading | high | static/html/InternetExplorerPanel.html (line 708) | Scripts are loaded using the `res://` protocol from a Windows DLL resource (aaResources.dll). This means the extension relies on executing code from a locally installed binary DLL, which is a significant attack surfac… | |
| 90 | Remote Code Loading | high | static/html/firefoxPanel.html (line 97) | The Firefox panel's receiveMessage handler does not validate the origin of incoming postMessages before processing or storing the gatewayURL in localStorage. Any page able to postMessage to the panel can overwrite the… | |
| 91 | Remote Code Loading | high | static/html/safariPanel.html (line 81) | The Safari panel's message handler accepts postMessages without origin validation and writes a gatewayURL from message data directly to localStorage. A malicious page that can send a postMessage with the correct struc… | |
| 92 | Remote Code Loading | high | static/html/panel.html (line 24) | The main Chrome panel page loads the gateway URL from localStorage (via loadCachedGateway.js) and sets it as the iframe src. Since the IE/Firefox/Safari panel handlers all write unvalidated postMessage-sourced URLs in… | |
| 93 | Remote Code Loading | high | js/Extension.built.min.js (line 74) | The extension fetches live configuration from hardcoded Amazon S3 endpoints per locale (e.g., `ubp-common-us-prod/cookiesync/cookiesync-config.json`) and applies it at runtime without any code update. This allows Amaz… | |
| 94 | Tracking | high | js/ubp/extension/contextual/peer-scripts/libraries/ActionLibrary.js (line 36) | ActionLibrary registers event listeners on arbitrary DOM elements using CSS selectors and event names (e.g., 'click', 'focus', 'change', 'blur') specified at runtime by Amazon's backend via the UBPActionRegister API. … | |
| 95 | Tracking | high | js/ubp/extension/contextual/peer-scripts/libraries/MetaDataLibrary.js (line 22) | MetaDataLibrary exposes four data collection APIs callable from the extension background: page referrer (revealing browsing history), full URL including path and query string, complete performance timing data, and scr… | |
| 96 | Tracking | high | js/ubp/extension/contextual/peer-scripts/libraries/ActionLibrary.js (line 36) | ActionLibrary registers event listeners on arbitrary page elements (identified by CSS selector) for arbitrary event types, both specified remotely by the extension background. When the event fires, a callback to _acti… | |
| 97 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 268) | The TextJsRegexEvaluator traverses all text nodes in the DOM (up to 500 nodes, 500 chars each) using a regex pattern dynamically supplied by Amazon's backend at runtime. The CssEvaluator and XPathEvaluator similarly a… | |
| 98 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/MetaDataLibrary.js (line 22) | MetaDataLibrary exposes four on-demand APIs to the extension backend: page referrer URL (revealing prior navigation), full current URL with path and query string (revealing user browsing behavior on all pages), comple… | |
| 99 | Unauthorized Data Collection | high | static/html/localProxy.html (line 55) | localProxy.html is a web_accessible_resource that external web pages can load. It proxies localStorage access between web page contexts and the extension's storage space via postMessage. External pages loading this re… | |
| 100 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/ScrapeDriver.js (line 1) | ScrapeDriver instantiates a full-document Scraper with access to the complete DOM and registers a chrome.runtime.onMessage listener that executes arbitrary scraping commands from the extension background. On command, … | |
| 101 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/MetaDataDriver.js (line 1) | MetaDataDriver creates a MetaDataLibrary instance with access to the entire window object and listens for extension runtime messages to execute metadata extraction on demand. The library can extract full page URLs, re… | |
| 102 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/WebpageDriver.js (line 1) | WebpageDriver instantiates an Instrumentor.WebpageLibrary with full document access and wires it to receive arbitrary commands from the extension background. The library name 'Instrumentor' and its async response patt… | |
| 103 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/GetUWLItemDriver.js (line 1) | GetUWLItemDriver instantiates GetUWLItemLibrary.GetUWLItem (Universal Wish List scraper) with full document access. On command from the extension background, it invokes the library's handle method to scrape product/it… | |
| 104 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/MetaDataLibrary.js (line 25) | MetaDataLibrary collects the full page URL including path and query parameters, detailed performance timing data, window dimensions, and HTTP referrer from every page the extension is active on. This breadth of passiv… | |
| 105 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 50) | WebpageInstrumentLibrary provides getText (extracts visible text from any DOM element by CSS selector), click (programmatically clicks any element), and input (silently sets form field values and fires synthetic input… | |
| 106 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 73) | getAttributes extracts arbitrary HTML attributes from all matching elements (potentially exposing CSRF tokens, hidden input values, or auth tokens in data-* attributes) while keydown injection can simulate keyboard in… | |
| 107 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 177) | The getPrice method walks the entire DOM tree of every visited page using a TreeWalker, scanning every text node for price patterns across multiple currencies (USD, EUR, GBP, JPY, INR). This aggressive full-document t… | |
| 108 | Unauthorized Data Collection | high | js/Extension.built.min.js (line 79) | The Identity service exposes getInstallationToken, getCustomerToken, and getInstallationId APIs consumed by Reporter and Dossier processes. These identity tokens are combined with behavioral telemetry from Titan and s… | |
| 109 | Unauthorized Data Collection | high | js/Extension.built.min.js (line 86) | The extension implements a cookie sync subsystem that periodically contacts cookie.browserapps.amazon.* endpoints across all Amazon locales with a 2-second sync interval. Combined with the chrome.cookies API permissio… | |
| 110 | Unauthorized Data Collection | high | js/Extension.built.min.js (line 85) | The extension exposes getCookieInfo and bulkGetCookieInfo as part of its internal Platform API, callable by remote iFrame-based processes via the messaging bus. These methods retrieve named cookies for specified URLs … | |
| 111 | Unauthorized Data Collection | high | js/Extension.built.min.js (line 86) | The extension embeds hidden iFrames pointing to amazon.com/gp/ubp/AA/serviceLocalStorage.html and serviceSatellite.html, then communicates with them via postMessage to read and write Amazon.com's localStorage. This cr… | |
| 112 | Unauthorized Data Collection | high | js/Extension.built.min.js (line 86) | The extension provides a LocalStorageAccessor service with getItem, bulkGet, and setItem wrappers over localStorage, exposed as part of the StorageManager with an AMAZON_COM_LOCAL_STORAGE storage type. Combined with t… | |
| 113 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 3) | The Scraper class implements a comprehensive, remotely-configurable DOM data extraction engine supporting six evaluator types: CSS selector, XPath, XPath2, URL regex, metatag, and text regex. The scraper accepts speci… | |
| 114 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 693) | The parseAmazonVendorData method uses hardcoded XPath selectors to extract product ASIN identifiers from Amazon's hidden buy-workflow form fields (ASIN, asin, o_asin, ASIN.0) and price data from product page DOM struc… | |
| 115 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 177) | The getPrice method performs a full-DOM tree walk across all text nodes in document.body looking for price-formatted text across 14 currency symbols including USD, GBP, EUR, JPY, INR, CNY, and others. This is a generi… | |
| 116 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 50) | The getText, click, and getAttributes instrumentors allow the extension background to remotely extract visible text content from arbitrary DOM elements, programmatically click any page element, and retrieve any elemen… | |
| 117 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 268) | The TextJsRegexEvaluator walks all text nodes in the DOM using the XPath expression descendant-or-self::*/text() and applies a remotely-supplied regex pattern and replacement to extract content. The regex is construct… | |
| 118 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/GetUWLItemDriver.js (line 4) | This driver instantiates GetUWLItemLibrary.GetUWLItem with the full page document and allows the extension background to remotely trigger wishlist and product item extraction from any Amazon page. The handle(request.p… | |
| 119 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 335) | The ReverseDFS algorithm starts at remotely-specified target DOM elements located via XPath and traverses up the DOM tree to a configured depth, applying multiple scrapers at each level. This targeted scraping pattern… | |
| 120 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/ScrapeDriver.js (line 1) | This driver instantiates a ScrapeLibrary.Scraper on the current page's document and exposes it to extension runtime messages, enabling the background script to instruct the content script to scrape arbitrary DOM conte… | |
| 121 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/drivers/chrome/ActionDriver.js (line 5) | The ActionDriver creates an ActionLibrary bound to the full page document and an actionHandler callback that sends arbitrary action messages to the extension runtime. The library can execute DOM actions (clicks, form … | |
| 122 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 47) | WebpageInstrumentLibrary provides a full DOM automation API: it can read the inner text of any element (getText), programmatically click elements (click), inject values into input fields (input), and simulate keyboard… | |
| 123 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 265) | The TextJsRegexEvaluator walks all text nodes of the entire page DOM (up to 500 nodes) and applies server-supplied regex patterns against their content to extract matching text. Because the regex expressions come from… | |
| 124 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/MetaDataLibrary.js (line 22) | MetaDataLibrary exposes APIs that collect detailed browser fingerprinting data: the page referrer, full URL and path, complete performance timing metrics (which reveal navigation patterns and browsing history timing),… | |
| 125 | Unauthorized Data Collection | high | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 47) | The `WebpageInstrumentLibrary` exposes a remotely-commandable API that can programmatically set form field values (`input`), dispatch synthetic keyboard events (including simulating keypresses), click arbitrary DOM el… | |
| 126 | Code Injection | medium | js/Extension.built.min.js (line 78) | The extension uses the Function constructor to dynamically assemble and execute JavaScript function bodies from string concatenation at runtime. This is a code injection vector that bypasses static analysis and could … | |
| 127 | Code Injection | medium | static/html/safariPanel.html (line 81) | The Safari panel's postMessage handler also accepts gatewayURL updates from any origin without validating msgEvent.origin. The URL is stored in localStorage and subsequently loaded into the main panel iframe, creating… | |
| 128 | Code Injection | medium | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 257) | The sandbox creation system injects hidden iframes into web pages using closed Shadow DOM with randomly-generated class names specifically designed to evade detection by page scripts and security scanners. The iframes… | |
| 129 | Data Exfiltration | medium | js/Extension.built.min.js (line 75) | The extension's core PostMessage transport broadcasts all inter-process messages with a wildcard target origin ('*') and can be configured to accept messages from any origin when validOrigins contains '*'. Messages ca… | |
| 130 | Network Interception | medium | static/js/baseProxy.js (line 1) | The wireEvents function relays all postMessage traffic between parent window and sandboxed iframe using wildcard target origins ('*') in both directions. The allowedHostNames regex patterns ('(amazonbrowserapp)' and '… | |
| 131 | Network Interception | medium | static/js/retryHandler.js (line 186) | The message event listener accepts messages from any origin without validating event.origin before dispatching to registered callbacks. Combined with postMessage calls using wildcard '*' target origin, any window or f… | |
| 132 | Network Interception | medium | js/ubp/extension/contextual/peer-scripts/drivers/chrome/PageMessagingDriver.js (line 5) | This content script (running at `document_start` on all Amazon domains) establishes a bidirectional channel that forwards ALL extension runtime messages to the page via `postMessage(request, "*")` with no origin restr… | |
| 133 | Obfuscation | medium | js/ubp/extension/contextual/peer-scripts/libraries/SandboxLibrary.js (line 229) | Injected DOM elements use randomized Base64-encoded UUID class names truncated to random lengths to obstruct detection. Combined with closed shadow roots and zero-dimension iframes, this obfuscation infrastructure is … | |
| 134 | Privilege Escalation | medium | js/ubp/extension/contextual/peer-scripts/libraries/WebpageInstrumentLibrary.js (line 30) | This library exposes remote-controlled page instrumentation primitives including DOM querying, text extraction, clicking elements, filling inputs, and firing keyboard events. That is effectively an automation backdoor… | |
| 135 | Privilege Escalation | medium | static/js/baseProxy.js (line 1) | The allowedHostNames allowlist is implemented as regex patterns that check if a hostname contains 'amazonbrowserapp' or 'browserapp' followed by 'amazon'. This is a weak allowlist — an attacker who registers a domain … | |
| 136 | Remote Code Loading | medium | js/Extension.built.min.js (line 75) | The extension fetches both logging-config.js and cookiesync-config.json from Amazon S3 at runtime to control its logging destinations and cookie sync behavior. The .js extension on the logging config suggests it may b… | |
| 137 | Tracking | medium | js/Extension.built.min.js (line 75) | The extension sends real-time usage telemetry (operation counters and timers) to an Amazon Forester metrics endpoint, with the target URL determined by the remotely-fetched logging-config.js. Each metric includes mark… | |
| 138 | Tracking | medium | js/Extension.built.min.js (line 85) | The extension contacts amazon.com/gp/ubp/json/config/liteBootstrap to retrieve locale configuration on startup with up to 10 retry attempts, leaking the user's locale and installation context to Amazon servers on ever… | |
| 139 | Tracking | medium | js/ubp/extension/contextual/peer-scripts/libraries/ActionLibrary.js (line 36) | ActionLibrary allows the extension to programmatically attach event listeners to any page element selected by a CSS selector, for any event type specified by the server. When the user triggers the specified event, the… | |
| 140 | Tracking | medium | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 131) | The UrlJsRegexEvaluator applies server-supplied regular expressions to the current page URL and extracts substrings using a replacement pattern. Both the match and replacement patterns are remotely configurable, allow… | |
| 141 | Tracking | medium | static/js/extension-config.js (line 1) | The extension tracks the installation reason and stores it under an `Identity`-namespaced key, linking installation events to an identity tracking system. The code also explicitly probes `window.sogouExplorer` to dete… | |
| 142 | Tracking | medium | js/ubp/extension/contextual/peer-scripts/libraries/MetaDataLibrary.js (line 22) | The MetaDataLibrary exposes APIs that collect the full page URL (including query parameters which may contain search terms, product IDs, or session tokens), page referrer (revealing navigation history between sites), … | |
| 143 | Tracking | medium | js/Extension.built.min.js (line 74) | The extension uses `eval()` within its RequireJS AMD module loader (`req.exec`) to execute dynamically loaded module code. Additionally, the `getActiveTabInfo` API continuously queries the currently active tab to extr… | |
| 144 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 24) | This is a general-purpose DOM scraping engine that accepts runtime-supplied CSS, XPath, XPath2, regex, and targeted-search specifications to extract arbitrary page content. On an extension with broad host access and t… | |
| 145 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 177) | The Universal Wish List scraper performs a full TreeWalker DOM sweep across all text nodes of any web page to find price patterns across multiple currencies, collects all image URLs with scoring, and calls extractValu… | |
| 146 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 231) | The MetatagEvaluator deserializes a JSON scraper specification received at runtime from Amazon's backend and extracts Open Graph and other meta tag content (og:title, og:type, og:url, og:image, og:description, article… | |
| 147 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 693) | parseAmazonVendorData reads hidden form field values (ASIN product identifiers from document.handleBuy.ASIN.value — an Amazon purchase-flow form), page titles, and prices from the live DOM on Amazon and third-party ve… | |
| 148 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 177) | The getPrice method uses document.createTreeWalker to walk every text node in the entire page body, matching price patterns across multiple currencies (USD, GBP, EUR, JPY, INR, etc.) on any domain. This full-DOM tree … | |
| 149 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/ScrapeLibrary.js (line 3) | The ScrapeLibrary implements a full-featured, remotely-commandable page scraping engine that can extract arbitrary DOM content via CSS selectors, XPath expressions, URL regex, meta tags, and text node traversal (up to… | |
| 150 | Unauthorized Data Collection | medium | js/ubp/extension/contextual/peer-scripts/libraries/GetUWLItemLibrary.js (line 117) | The WishlistScraper performs deep DOM traversal to extract product ASINs (from hidden form fields), titles, prices, and all page images from Amazon product pages. Critically, it also operates on non-Amazon third-party… | |
| 151 | Tracking | low | static/js/extension-config.js (line 1) | The extension detects the presence of the Sogou Explorer browser (a Chinese browser) via the global window.sogouExplorer property and conditionally modifies extension storage state based on the detected environment. T… | |
| 152 | Tracking | low | static/js/extension-config.js (line 1) | On every install or update event, the extension records the install reason to local storage under keys that include 'ubpv2.Identity.installation.reason', indicating persistent identity and lifecycle tracking tied to t… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
239
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| github.com | /requirejs/requirejs/blob/master/LICENSE | https://github.com/requirejs/requirejs/blob/master/LICENSE |
| lodash.com | - | https://lodash.com/ |
| dojofoundation.org | - | http://dojofoundation.org/ |
| underscorejs.org | /LICENSE | http://underscorejs.org/LICENSE |
| lodash.com | /license | https://lodash.com/license |
| underscorejs.org | - | http://underscorejs.org |
| www.w3.org | /1999/xhtml | http://www.w3.org/1999/xhtml |
| horizonte.browserapps.amazon.com | /crossdomainlocalstoragereader | https://horizonte.browserapps.amazon.com/crossdomainlocalstoragereader |
| *.amazon.com | /* | http://*.amazon.com/* |
| *.amazon.ca | /* | http://*.amazon.ca/* |
Showing 1 to 10 of 240 rows
Rows per page:
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.