What our analysis found

eRail.in, used by 300,000 people, is rated caution by Extension Auditor. Our code review reported 4 findings (2 critical, 2 medium), led by credential theft. It comes from a trusted publisher and was last updated in August 2024.

Key findings

• critical· credential theft —The content script is injected into all pages and listens to window postMessage events without origin validation, forwarding any action (including GETCOOKIE) to the background. Combined with the background's ability to fetch cookies for Railways domains and the content script's onMessage handler that passes data back to the page, any malicious website can steal sensitive session cookies.
• critical· credential theft —The background script processes a GETCOOKIE message from any tab (including content scripts injected into attacker pages) and retrieves all cookies for the specified domain (e.g.,.) using chrome.cookies.getAll. The cookies are then sent back to the requesting tab, enabling theft of authentication tokens.
• medium· other —The bundled manifest uses manifest_version 2 and includes permissions webRequest, webRequestBlocking, while the published summary on CWS indicates manifest_version 3 with only tabs, cookies permissions. Host permissions in the bundled manifest omit domains present in the published summary. This discrepancy may indicate an outdated or unreviewed code version.
• medium· code injection —The extension uses eval() on data fetched from (response text) and on OCR-rendered captcha text. Executing external data with eval can lead to arbitrary code execution if the source is compromised, posing a code injection risk.

The extension is a legitimate Indian Railways tool but contains a critical vulnerability: it injects content scripts into all websites and exposes cookie retrieval APIs to any webpage via postMessage, potentially allowing any site to steal Railways session cookies. Combined with eval of external data and manifest discrepancies, the extension is suspicious.