What our analysis found

Friender — Social CRM, Engagement & Sales Automation is rated caution by Extension Auditor. Our code review reported 5 findings (3 high, 2 medium), led by other. It comes from a trusted publisher and was last updated in October 2026.

Key findings

• High

  Other

  The bundled manifest does not match the live CWS listing: the published version additionally requests `clipboardRead` and `alarms`, adds `[domain withheld]-east-2`, `[domain withheld]-east-1`, `[domain withheld]-east-2` and `[domain withheld]` hosts, and web-accessible-resources `pickr. ` to `<all_urls>`. The bundle also looks like a pre-release build (popup title "Engagement Monster", `[domain withheld]`, `[domain withheld]`, ` /` API paths, `"isLive":false`), so no code in it accounts for the published `clipboardRead` permission that the third-party vendor also flags. Clipboard reading on pages is unreviewable from this ZIP and undisclosed in the listing.

  Show more — Other
• High

  Unauthorized Data Collection

  Using the harvested `fb_dtsg` token the content script pages `FriendingCometFriendsListPaginationQuery` for the user's entire friend roster (id, name, short name, gender, profile-picture URI, mutual-friend count), then `graphqlbatch` for a per-friend message count (`message_limit: 0`, so counts only, not message bodies) and `timeline_feed_units` for the names and IDs of everyone who reacted to or commented on the user's posts, and uploads all of it to the vendor's API Gateway endpoint; ` ` also forwards the raw friend nodes over [domain withheld] to `[domain withheld]`. The destination is first-party and the sync is consistent with the listed purpose, but the CWS data-collection disclosure is empty, so personal information — including that of third parties who never installed the extension — is collected under no declared category.

  Show more — Unauthorized Data Collection
• High

  Credential Theft

  `w.login()` scrapes `[domain withheld] and returns `{FacebookId, FacebookUsername, FacebookName, FacebookImage, dtsg}` (line 317); `k()` then POSTs that whole object — the live Facebook `fb_dtsg` CSRF token plus the user's Facebook identity and their Friender account email — to a hardcoded plaintext `[domain withheld]. This is almost certainly a leftover development endpoint rather than deliberate theft, but it is a real egress path for a session-bound Facebook anti-CSRF token: any local process that binds silently receives it, and the token should never leave the extension at all (every legitimate use of it in and is local).

  Show more — Credential Theft
• Medium

  Network Interception

  The static DNR rule forges `Origin: [domain withheld] on XHRs, which is what lets the extension's session-riding GraphQL and `removefriendconfirm.php` writes pass Facebook's origin checks. The problem is scope: the rule has no `initiatorDomains`, `excludedInitiatorDomains` or `tabIds`, and `urlFilter: "[domain withheld]"` is a substring match, so any XHR from any website to any URL containing that substring gets a same-origin Origin header. That degrades one of Facebook's CSRF defences browser-wide for the user, well beyond the extension's own requests, and look-alike hosts match too.

  Show more — Network Interception
• Medium

  Privilege Escalation

  `:53` lists `[domain withheld] alongside `[domain withheld] in `externally_connectable`, and this listener never validates the sender origin. The `unfriend` case passes `t.payload` straight to `$()`, which issues authenticated `removefriendconfirm.php` POSTs for every supplied friend ID, `syncprofile` returns the user's Facebook profile to the caller, and `extensionInstallation` overwrites the stored `fr_token`. Any process on the user's machine serving plaintext port 3000 — a dev server, another app, or local malware — can therefore destructively unfriend arbitrary accounts and read the user's Facebook identity.

  Show more — Privilege Escalation