Chrome Web StoreNo malware found
In code review
Our reviewer read this extension’s code and found no malicious behaviour. Review the permissions below before installing.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Dex for Chrome - Personal CRM and Rolodex, used by 10,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by unauthorized data collection. It comes from a trusted publisher and was last updated in August 2026.
Key findings
- High
Unauthorized Data Collection
On a getCookies message (handler registered at:218 with no sender-origin check), the extension reads the complete cookie jar for.[domain withheld] and.[domain withheld] — the websites table at -872 supplies only the domains ('c_user','xs','sessionid' names are never used as a filter, the filter at matches on domain alone), so HttpOnly session tokens that page JavaScript can never read are included — and forwards them into the requesting tab's content script, which re-broadcasts them to the page with window.postMessage(..., '*'). The destination is first-party (the sink is gated to [domain withheld] via isDexSite()), but authentication credentials are not in the CWS-disclosed collection list, which declares only 'Website content', and full third-party session cookies are account-takeover-grade material; the wildcard postMessage target also exposes them to any other script or iframe present in the Dex page.
Analyst notes
The bundle is a genuine personal-CRM extension: is verbatim InboxSDK (68 'inboxsdk' references, the XHR wrappers at: and the ext-corb-workaround MessagePort at),:1-18 is InboxSDK's standard MAIN-world injection of the packaged, and the only network sink in the reviewed code is a first-party POST to [domain withheld] (:508) for AI message drafting. The signals are circular here: the internal note states the malware label came from a 2026-09-13 bulk malext-feed import that was explicitly 'not an independent code review', and the permhash cluster is almost certainly Dex's own version history carrying that same imported label; chrome-stats likelihood, a trusted-publisher badge and a rating all contradict the malware label. One real issue stands and contradicts a clean bill::246-306 harvests the full [domain withheld] and [domain withheld] cookie jars (filtered by domain only, so HttpOnly session tokens are included) and hands them to the requesting tab, which the (not-supplied) re-broadcasts to the page with window.postMessage(...,'*') — gated to [domain withheld] via isDexSite(), so first-party, but authentication data is not in the CWS disclosure ('Website content' only). Caveat on scope: only 3 of the 7 files listed in were supplied; (~1.79 MB, where most of the counts live) was absent from extract_dir and I verified the cookie sink from the archived v3.0.4 CRX instead, so this verdict is medium, not high, confidence. Also note the prompt's 'bundled manifest' and the risk-engine flags (MV2, document_start, activeTab, xing) describe an older release; this ZIP is MV3, document_end, and matches the live listing apart from [domain withheld] vs host variations.
Dex for Chrome - Personal CRM and Rolodex Chrome extension security report
ID: amlpnkfionniifnajgcalfndolieichk
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Dana HQ Inc
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- *://*.linkedin.com/*
- *://*.facebook.com/*
- *://*.instagram.com/*
- *://*.twitter.com/*
- *://*.mail.google.com/*
- *://*.xing.com/*
- 1 high
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Be better at relationships with Dex. Visualize, understand, and manage your relationships for free.
Read the publisher’s full description
Be better at relationships with Dex. Dex reminds you to keep in touch with the people you care about. Easily visualize, understand, and manage all your relationships for free. By installing the extension, you agree to Dex's Terms of Service (getdex.com/termsofservice). ★ Integrate where you need it! - Add Dex to Chrome to manage relationships from Facebook, Messenger, Twitter, Gmail, and more! - No data entry or separate websites needed. ★ Stay in touch better - Configure Dex to send regular reminders: maintain relationships even when life gets busy. - Stay warm with your network and see people you haven’t seen in a while. ★ Remember the important details - Remember the name of your coworker’s daughter? What you did with your friend from college? - Dex makes it easy to remember important details. Be more thoughtful and better at relationships. ★ Become a superconnector - With the Dex Dashboard, organize all your relationships with custom tags and views. - Search through all the notes you’ve taken in one place. Make connections that help your friends and strengthen your relationships.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Social Networking
- Cisco Webex Extension24,000,000 users
- LINE4,000,000 users
- Mosaic Wallet4,000,000 users
- vidIQ Vision for YouTube4,000,000 users
- Google Mail Checker2,000,000 users