Extension Auditor
Extension Auditor
Sign Up

Xactware ClickOnce

ID: ghonblphoimcehigdfdmomaochonfobc

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Removed
Version
1.3
Size
0.26 MB
Rating
3.0/5
Reviews
8
Users
80,000
Type
Extension
Updated
Dec 3, 2022
Category
Productivity Workflow
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
Xactware Solutions, IncView Profile
Privacy
Privacy Policy
Help
Help Center
Country
US
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Address
1100 W Traverse Pkwy Lehi, UT 84043 US
Total Extensions
2
Active
0
Obsolete
2
Listed
2
Unlisted
0
Total Users
90,000

Enable ClickOnce support in the Browser for Xactimate/XactContents online Estimate Writer.

Allows users of Xactimate and XactContents online the ability to open and view or edit estimates.

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking
Permission
Critical
This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
Dangerous Permission Combination
Risk Factor
Critical
This extension can intercept, modify, and block web requests in real-time.
nativeMessaging
Permission
High
This permission enables communication with applications installed on your computer. Rated High because it can exchange data with native programs, potentially exposing system-level information and local files.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation• 15% increase: Older manifest version lacks modern security controls
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2
https://*.xactimate.com/*
Permission
Unknown
No classification available for this permission.
https://xactimate.com/*
Permission
Unknown
No classification available for this permission.
https://*.xactcontents.com/*
Permission
Unknown
No classification available for this permission.
https://xactcontents.com/*
Permission
Unknown
No classification available for this permission.

The bundled manifest declares manifest_version 2 and includes webRequest and webRequestBlocking permissions, while the published manifest summary claims manifest_version 3 with only nativeMessaging and host_permissions. This discrepancy can mislead users about the extension's capabilities and may violate Chrome Web Store policy.

manifest.json (Line 1)
{  "background": {    "scripts": [      "js/background-script.js"    ]  },  "manifest_version": 2,  "name": "Xactware ClickOnce",  "version": "1.3",  "description": "Enable ClickOnce support in the Browser for Xactimate/XactContents online Estimate Writer.",  "icons": {    "128": "icons/128.png"  },  "content_scripts": [    {      "matches": [        "https://*.xactimate.com/*",        "https://xactimate.com/*",        "https://*.xactcontents.com/*",        "https://xactcontents.com/*"      ],      "js": [        "js/export.js"      ],      "run_at": "document_start"    }  ],  "permissions": [    "webRequest",    "webRequestBlocking",    "nativeMessaging",    "https://*.xactimate.com/*",    "https://xactimate.com/*",    "https://*.xactcontents.com/*",    "https://xactcontents.com/*"  ]}

By severity

Critical0
High1
Medium0
Low0

Versions scanned

None of the 5 scanned versions have more than one unique code-review finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
No versions with multiple unique findings.

Files with findings

1 distinct path — top paths by unique finding count:

  • manifest.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Other
high
manifest.json (line 1)The bundled manifest declares manifest_version 2 and includes webRequest and webRequestBlocking permissions, while the published manifest summary claims manifest_version 3 with only nativeMessaging and host_permission…
1.3
URLs
10
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
xactimate.com/addons/XactwareClickOnceHelper.exehttps://xactimate.com/addons/XactwareClickOnceHelper.exe
ns.adobe.com/xap/1.0/mm/http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com/xap/1.0/sType/ResourceRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
*.xactimate.com/*https://*.xactimate.com/*
xactimate.com/*https://xactimate.com/*
*.xactcontents.com/*https://*.xactcontents.com/*
xactcontents.com/*https://xactcontents.com/*
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 5 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In