What our analysis found

MonokaiToolkit, used by 10,000 people, is rated caution by Extension Auditor. Our code review reported 5 findings (2 critical, 3 high), led by credential theft. It was last updated in March 2026.

Key findings

• Critical

  Credential Theft

  `M8_EXECUTE` with `method: "__request__"` passes a page-supplied options object (including an arbitrary absolute `url`) straight into the axios adapter, whose default headers already contain the victim's complete [domain withheld] cookie jar including the `xs` session token (:6754-6772). Any page that can reach the relay can therefore have the service worker POST live Facebook session credentials to a host of its choosing, outside the extension's host_permissions and outside normal cookie scoping. The response body is returned to the caller, making this a full authenticated request proxy for the victim's account.

  Show more — Credential Theft
• Critical

  Privilege Escalation

  This relay forwards page-origin postMessages to privileged background handlers with no origin or capability check, and its injection matches include `*://localhost/*`, `*:// and `*://[domain withheld] in addition to the publisher's own domain. `M8_INIT` returns the harvested Facebook `EAA...` access token and user id, `M8_STORAGE get` reads `m8_access_token` out of storage, and `M8_CHROME` is a generic `chrome[api][method](...args)` dispatcher over Any locally served page — or any content on the non-publisher `[domain withheld]` origin — can thus read the victim's Facebook session credentials, so this flow is not covered by the first-party 'Authentication information' disclosure.

  Show more — Privilege Escalation
• High

  Credential Theft

  The extension silently fetches the Ads Manager page with the victim's cookies and scrapes the embedded `EAA...` Graph API token, then persists it in `storage.local` under `m8_access_token` and serves it to web pages via `M8_INIT`. This is a long-lived, broadly scoped account credential obtained by scraping an interstitial the user never visited, and `M8_REAUTH` (:6939) will even open an Ads Manager tab to drive the user through re-authentication when the scrape fails. Combined with the page relay above it constitutes silent harvesting of an account-takeover-grade token rather than use of the user's ordinary session.

  Show more — Credential Theft
• High

  Network Interception

  A MAIN-world content script replaces window.WebSocket with a proxy that taps the Messenger edge-chat socket and broadcasts every incoming message delta, body included, via `postMessage` to the whole page;:32-55 then parses out thread id, sender id, sender name and body and forwards them over `M8_INCOMING_MESSAGE`. No handler for that message exists in, so the consumer is the offscreen ` ` that is listed in but was not supplied for review, leaving the destination of the intercepted private conversations unverifiable. The broadcast to `window` with target origin `*` also exposes message contents to any other script running on [domain withheld].

  Show more — Network Interception
• High

  Network Interception

  declarativeNetRequest rules rewrite Origin, Referer and Sec-Fetch-* headers on requests to [domain withheld], [domain withheld] and the Messenger edge-chat endpoints so that extension-originated traffic is indistinguishable from in-page navigation. The only purpose of forging these headers is to defeat Facebook's origin and CSRF checks so the background service worker can drive authenticated account, ads and chat endpoints on the user's behalf, which is what turns the harvested cookies and token into usable account control.

  Show more — Network Interception