Ac Message To
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
v1.0
Open WhatsApp chats with any number not saved in your contacts!
--------------------------------------------------------
Inicia chats de WhatsApp con cualquier numero no guardado en tus contactos
Tags
Privacy Practices
Security Analysis — Ac Message To
Permissions
Code Patterns Detected
External Connections
Package Contents 18 files · 1.4MB
What This Extension Does
AC Message To is a Chrome extension that allows users to open WhatsApp chats with any number not saved in their contacts. It's designed for individuals who frequently interact with unknown numbers on WhatsApp. However, its functionality and permissions raise some concerns.
Permissions Explained
- storageexpected: This permission lets the extension store data locally on your device.
Technical: The extension can access local storage using Chrome'schrome.storageAPI. This allows it to save and retrieve data, potentially storing sensitive information if not properly sanitized. - contextMenusexpected: This permission enables the extension to create custom context menu items in your browser.
Technical: The extension useschrome.contextMenusAPI to create context menu items. This allows it to inject custom actions into your browsing experience, potentially leading to XSS vulnerabilities if not properly sanitized. - notificationsexpected: This permission lets the extension display notifications in your browser.
Technical: The extension useschrome.notificationsAPI to display notifications. This allows it to interrupt your browsing experience and potentially distract you from security-related issues.
Your Data
AC Message To accesses local storage on your device and sends data to WhatsApp's API, as well as other external domains. It does not collect any sensitive information from the user.
Technical Details
www.w3.org, api.whatsapp.com, reactjs.org, and www.paypal.com. The communication protocol is HTTP, with no encryption observed. The data types exchanged are likely to be JSON objects containing chat metadata.Code Findings
This finding indicates that the extension uses innerHTML assignments, which can lead to cross-site scripting (XSS) vulnerabilities if not properly sanitized.
Technical: The extension's code contains instances of innerHTML assignment in JavaScript files. This pattern is commonly used for DOM manipulation but can be exploited by malicious scripts if not properly sanitized.
💡 Legitimate extensions often use innerHTML assignments to dynamically update page content, but this requires proper sanitization to prevent XSS attacks.
This finding suggests that the extension uses String.fromCharCode for obfuscation purposes, which can make it harder to analyze and understand its behavior.
Technical: The extension's code contains instances of String.fromCharCode used in conjunction with other functions. This pattern is often used for obfuscation but can also be indicative of malicious intent.
💡 Legitimate extensions may use String.fromCharCode for encoding or decoding purposes, but this should not obscure the underlying functionality.
This finding indicates that the extension creates custom context menu items in your browser.
Technical: The extension uses chrome.contextMenus API to create context menu items. This allows it to inject custom actions into your browsing experience, potentially leading to XSS vulnerabilities if not properly sanitized.
💡 Legitimate extensions often use context menus to provide additional functionality or actions for the user.
This finding indicates that the extension displays notifications in your browser.
Technical: The extension uses chrome.notifications API to display notifications. This allows it to interrupt your browsing experience and potentially distract you from security-related issues.
💡 Legitimate extensions often use notifications to inform users of important events or updates.
This finding indicates that the extension sets up event listeners for various browser events.
Technical: The extension's code contains instances of addEventListener used to set up event listeners. This allows it to respond to user interactions and other browser events, potentially leading to security issues if not properly sanitized.
💡 Legitimate extensions often use event listeners to provide additional functionality or actions for the user.
AC Message To is a Chrome extension that raises some concerns regarding its permissions and code behavior. While it provides a useful feature, its potential XSS vulnerabilities and obfuscation patterns warrant further investigation and caution from users.
