Read&Write for Google Chrome™

What This Extension Does

The Read&Write for Google Chrome extension aims to boost reading and writing confidence across various devices, in different environments such as class, work, or home.

Permissions Explained

• activeTab: Allows the extension to access the currently active tab's content.

+ Standard for extensions that need to interact with web pages.

• contextMenus: Enables the extension to create custom context menus within Chrome.

+ Unusual; typically used by extensions that provide additional menu options, but not necessarily required for this extension's described functionality.

• storage: Grants access to local storage, allowing the extension to store and retrieve data.

+ Standard for extensions that need to persist user settings or data.

• tabs: Allows the extension to interact with tabs, including creating new ones.

+ Unusual; typically used by extensions that provide tab management features, but not necessarily required for this extension's described functionality.

• identity: Provides access to user identity information, such as email addresses.

+ Unusual; typically used by extensions that require authentication or authorization, which is not explicitly mentioned in the description.

• scripting: Enables the extension to execute scripts within web pages.

+ Standard for extensions that need to interact with web content dynamically.

• management: Grants access to Chrome's management API, allowing the extension to manage other extensions or browser settings.

+ Unusual; typically used by enterprise-focused extensions or those requiring advanced configuration options.

• offscreen: Allows the extension to run in the background even when not visible on screen.

+ Standard for extensions that need to perform tasks without user interaction.

• search: Enables the extension to access search functionality within Chrome.

+ Unusual; typically used by extensions that provide custom search engines or features, but not necessarily required for this extension's described functionality.

• alarms: Grants access to Chrome's alarm system, allowing the extension to schedule tasks.

+ Standard for extensions that need to perform periodic tasks without user interaction.

• gcm (Google Cloud Messaging): Enables the extension to receive push notifications from Google servers.

+ Unusual; typically used by extensions that require real-time updates or notifications, which is not explicitly mentioned in the description.

• downloads: Allows the extension to access and manage downloads within Chrome.

+ Standard for extensions that need to interact with downloaded files.

• <all_urls>: Grants access to all URLs, including those on secure (HTTPS) connections.

+ Critical risk; this permission is unusual for an extension claiming to provide reading and writing assistance, as it suggests the extension may be accessing sensitive or proprietary content.

What We Found in the Code

• eval() used — can execute arbitrary code: This flag indicates that the extension uses eval() to execute JavaScript code. While eval() can pose a security risk if used with untrusted input, its presence alone is not necessarily unusual for an extension that needs to dynamically interact with web content.
• innerHTML assignment — potential XSS vector: The use of innerHTML assignments may be a concern if the extension uses this method with untrusted data. However, without more context, it's difficult to determine whether this is a genuine security risk or simply a normal coding pattern for UI rendering.
• Makes HTTP requests: This flag indicates that the extension makes external HTTP requests. Given its purpose and permissions, this is likely used for API calls or fetching resources necessary for its functionality.
• Listens to keyboard events: The extension listens to keyboard events, which may be used for shortcuts or other interactive features. While unusual for an extension providing reading and writing assistance, it's not necessarily a security risk without more context.
• Potential crypto-mining code detected: This flag suggests that the extension contains code that could be used for cryptocurrency mining. However, without further analysis or evidence of actual mining activity, this finding is speculative.

External Connections

The extension communicates with several external domains, including:

• www.w3.org (World Wide Web Consortium)
• docs.google.com (Google Drive)
• schemas.microsoft.com (Microsoft Open Specifications)
• rwgoogle-webservices-7.texthelp.com, rwgoogle-webservices-eu.texthelp.com (Texthelp's own services)
• onedrive.live.com (Microsoft OneDrive)
• reading.texthelp.com, fluency.texthelp.com, pra.texthelp.com (Texthelp's own services)

These connections appear expected for an extension providing reading and writing assistance, as they likely relate to API calls or resource fetching necessary for its functionality.

Things to Consider

Based on the extension's name, description, and permissions, users may want to consider the following:

• The extension's broad permission set, including <all_urls>, suggests it may be accessing sensitive content. Users should carefully evaluate whether this is necessary for its described functionality.
• The presence of eval() and potential XSS vectors in the code may indicate a need for more secure coding practices or input validation.
• The unusual permissions (e.g., contextMenus, tabs) may suggest that the extension provides additional features beyond reading and writing assistance, which could be relevant to users' decisions about installing the extension.