7tv

What This Extension Does

Permissions Explained

• scripting: Allows the extension to run scripts in web pages, which is standard for extensions that need to interact with websites.
• storage: Enables the extension to store data locally, such as user preferences or settings. This is common for extensions that require saving state between sessions.
• activeTab: Grants access to the currently active tab's content, allowing the extension to read and modify it. This permission is typical for extensions that need to interact with web pages in real-time.
• management: Provides broad permissions related to managing browser settings and extensions. While this might seem unusual, it could be necessary for an extension that needs to configure or manage other extensions or browser features.
• *://*.twitch.tv/*: This high-risk permission is specific to Twitch TV and allows the extension to access all subdomains of twitch.tv. Given the extension's focus on Twitch, this is expected.

What We Found in the Code

• innerHTML assignment: The use of innerHTML for assigning content could potentially introduce XSS (Cross-Site Scripting) vulnerabilities if untrusted data is used. However, without more context, it's difficult to say whether this is a genuine concern.
• Makes HTTP requests: This is a normal pattern in web development and likely used by the extension to fetch resources or make API calls for its functionality.
• Listens to keyboard events: Keyboard listeners are often used for shortcuts or UI interactions. Without more context, it's hard to say if this is unusual for an extension that needs user input.
• Reads clipboard content: This could be used for various purposes, including auto-filling forms or handling user input. It might seem broad but is not inherently malicious.

External Connections

• www.w3.org: Expected for standard web development and likely used for HTML/CSS standards.
• 7tv.app, github.com, 7tv.io, cdn.7tv.app: These are related to the extension's own infrastructure or resources, which is expected.
• kick.com, twitch.tv, tinyurl.com, bit.ly, addons.mozilla.org, files.kick.com, static-cdn.jtvnw.net: Some of these domains seem unrelated to the extension's primary functionality. For example, kick.com and files.kick.com might be used for resources or APIs but could also indicate broader access than necessary.

Things to Consider

• The extension has a broad permission set, including management permissions that could potentially allow it to modify browser settings beyond its intended purpose.
• The use of innerHTML assignment without more context is a potential concern, especially if the extension handles user-provided data or interacts with untrusted sources.
• The extension's communication with various domains suggests it might be accessing resources or APIs not directly related to its primary functionality on Twitch and YouTube.