Extension Auditor
Extension Auditor
Sign Up

Link Popper

ID: icejebfpfnhgpdlchhfjpdnddcdamoje

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Removed
Version
1.4.2
Size
0.08 MB
Rating
0.0/5
Reviews
0
Users
50
Type
Extension
Updated
Nov 6, 2024
Category
Productivity Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Trusted
Author
maltozeView Profile
Privacy
Privacy Policy
Help
Help Center
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
3
Active
2
Obsolete
1
Listed
3
Unlisted
0
Total Users
4,178

A browser extension that lets you browse linked pages without leaving the current one.

Link Popper is a convenient browser extension that provides link preview functionality. When a link on the page is clicked, the extension opens a quick view on the current page to quickly preview the link's content. https://github.com/maltoze/link-popper

Item
Type
Severity
Description
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.

The declarativeNetRequest rule unconditionally removes Content-Security-Policy and X-Frame-Options from every HTTP response for every resource type and every origin while the extension is installed. Stripping CSP from main-frame and script responses removes the sites' own XSS defences; stripping XFO removes clickjacking protection. The rule is not scoped to sub-frame responses (where it would be sufficient for the iframe preview feature), so the user's security posture is degraded for all browsing, not just link previews.

rules.json (Line 1)
[  {    "id": 1,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "x-frame-options",          "operation": "remove"        },        {          "header": "X-Frame-Options",          "operation": "remove"        },        {          "header": "content-security-policy",          "operation": "remove"        },        {          "header": "Content-Security-Policy",          "operation": "remove"        },        {          "header": "cross-origin-resource-policy",          "operation": "set",          "value": "cross-origin"        },        {          "header": "cross-origin-embedder-policy",          "operation": "set",          "value": "credentialless"        }      ]    },    "condition": {      "resourceTypes": [        "csp_report",        "font",        "image",        "main_frame",        "media",        "object",        "other",        "ping",        "script",        "stylesheet",        "sub_frame",        "webbundle",        "websocket",        "webtransport",        "xmlhttprequest"      ]    }  }]

By severity

Critical0
High0
Medium1
Low0

Versions scanned

None of the 11 scanned versions have more than one unique code-review finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
No versions with multiple unique findings.

Files with findings

1 distinct path — top paths by unique finding count:

  • rules.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Network Interception
medium
rules.json (line 1)The declarativeNetRequest rule unconditionally removes Content-Security-Policy and X-Frame-Options from every HTTP response for every resource type and every origin while the extension is installed. Stripping CSP from…
1.4.2
URLs
5
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
www.w3.org/2000/svghttp://www.w3.org/2000/svg
jedwatson.github.io/classnameshttp://jedwatson.github.io/classnames
fb.me/use-check-prop-typeshttp://fb.me/use-check-prop-types
github.com/maltoze/link-popper/issueshttps://github.com/maltoze/link-popper/issues
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Version
Size
Is Malicious
Findings
Permhash
1.4.2
Latest
0.08 MB
Benign
1
712d9dd455f504f65e3ee8142d88b933ff476a1a8b7fec7df9dd532c1a431614
1.4.1
0.08 MB
Benign
—
712d9dd455f504f65e3ee8142d88b933ff476a1a8b7fec7df9dd532c1a431614
1.4.0
0.08 MB
Benign
—
712d9dd455f504f65e3ee8142d88b933ff476a1a8b7fec7df9dd532c1a431614
1.3.1
0.07 MB
Benign
—
712d9dd455f504f65e3ee8142d88b933ff476a1a8b7fec7df9dd532c1a431614
1.3.0
0.07 MB
Benign
—
712d9dd455f504f65e3ee8142d88b933ff476a1a8b7fec7df9dd532c1a431614
1.2.1
0.06 MB
Benign
—
9126f12ce5d0e610bb74da304b6bd0cd648428e59e74326fbd5affaa70d2257e
1.2.0
0.06 MB
Benign
—
9126f12ce5d0e610bb74da304b6bd0cd648428e59e74326fbd5affaa70d2257e
1.1.2
0.03 MB
Benign
—N/A
1.1.1
0.03 MB
Benign
—N/A
1.0
0.03 MB
Benign
—N/A
Showing 1 to 10 of 20 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In