Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: Dictionary

CRITICAL RISK

Dictionary

ID: nhbchcfeodkcblfpdjdhelcfbefefmag

Extension Info & Metadata

Status

Active

Version

23.11.11

Size

1.85 MB

Rating

4.3/5

Reviews

Users

6,000

Type

Extension

Updated

Dec 28, 2023

Publisher Contextual Analysis

Trusted

Author: e-dictionary.orgView Profile
Privacy: Privacy Policy
MX records exist: No
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: No
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Full-featured dictionary extension

Easily look up word definitions, pronunciations and synonyms as you browse the web

User Growth

Showing data from Feb 15, 2023 to Feb 14, 2024

Versions

No change in user count

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 22 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High1

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
23.11.11 Code review	5

Extension Version	Code Review Findings
23.11.11	5

Files with findings

2 distinct paths — top paths by unique finding count:

background-script/background.js3
assets/rules.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	assets/rules.json (line 1)	The extension silently strips the Content-Security-Policy response header from every website the user visits (both top-level pages and all sub-frames) using a declarativeNetRequest rule. CSP is the primary browser mec…	23.11.11
2	Network Interception	critical	assets/rules.json (line 19)	A second declarativeNetRequest rule strips the X-Frame-Options header from every sub-frame response across all websites. X-Frame-Options is a critical clickjacking defense that prevents pages from being embedded in if…	23.11.11
3	Unauthorized Data Collection	high	background-script/background.js (line 3899)	The extension uses the `cookies` permission to access the LSID authentication cookie from accounts.google.com to determine whether the user is currently signed in to their Google account. While the boolean result is o…	23.11.11
4	Tracking	medium	background-script/background.js (line 10)	The extension generates a persistent random UUID as a client ID stored in local storage and transmits it along with usage events (install, uninstall, context menu clicks) to Google Analytics using a hardcoded Measurem…	23.11.11
5	Unauthorized Data Collection	medium	background-script/background.js (line 3872)	On every tab activation and tab update event, the background script queries whether the user is in a normal (non-incognito) window, checks their Google sign-in status via cookie, measures days since install, and count…	23.11.11

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.example.com	-	http://www.example.com
chrome.google.com	/webstore/detail/dictionary/nhbchcfeodkcblfpdjdhelcfbefefmag	https://chrome.google.com/webstore/detail/dictionary/nhbchcfeodkcblfpdjdhelcfbefefmag
o526305.ingest.sentry.io	/6244539	https://[email protected]/6244539
*	/*	http:///
*	/*	https:///
www.google.com	/search	https://www.google.com/search?q=${t}+${n}`,applyCss:(
duckduckgo.com	-	https://duckduckgo.com/?q=${t}+${n}`,applyCss:(
www.google-analytics.com	/mp/collect	https://www.google-analytics.com/mp/collect
www.google-analytics.com	/debug/mp/collect	https://www.google-analytics.com/debug/mp/collect
forms.gle	/oRACFiJQCZW77Ssu8	https://forms.gle/oRACFiJQCZW77Ssu8

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

So far it works great, not only giving a popup on your selected term, but also having a Define box in by clicking the extension icon in the bar. What does NOT work well is when you have a term in an edit box that is spelled wrong, so you click on the red-squiggly term to get the proper spelling; but then the word is selected and this extension pops up the definition, not my intension and annoying every time it happens. But then, the last dictionary extension didn't even work in an edit box. <shug> Since the extension may not be able to detect when it's defining a just-spell-corrected term, it should probably offer the option to not function in an edit control.

Chris Sherwood·27 Oct 2024

и как это работает? при воде слова в поле для перевода ничего не происходит, при переводе на любом сайте тоже ничего

Ben Min·21 Oct 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

Dictionary

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating