Xclusiveloaded News
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Xclusiveloaded News is an entertainment media organization that provides readers with the most recent, accurate, and verified News on various topics.
Xclusiveloaded News has gained popularity among its users due to its captivating daily publications.
This Chrome extension is the perfect tool to ensure you are always informed about the latest news on Xclusiveloaded News.
Stay in the loop with the latest posts on Xclusiveloaded News by receiving notifications through this convenient Chrome extension.
Tags
Privacy Practices
Security Analysis — Xclusiveloaded News
Permissions
Code Patterns Detected
External Connections
Package Contents 171 files · 1.6MB
What This Extension Does
The Xclusiveloaded News extension appears to be a news aggregator, but its description is unavailable. It has no users and is categorized under Lifestyle/entertainment.
Permissions Explained
- https://xclusiveloaded.ng/*check this: This permission allows the extension to access content from the specified domain, which may include news articles or other resources.
Technical: Thehttps://xclusiveloaded.ng/*permission grants access to a specific domain, potentially exposing users to data exposure risks if not properly secured. The scope of this permission exceeds what's needed for a typical news aggregator extension, raising concern about potential misuse. ⚠ 1
Your Data
The extension accesses content from various domains, including some related to web development and security. It sends data to the specified domain, but the exact nature of this data is unclear.
Technical Details
www.w3.org, html.spec.whatwg.org, github.com, and others, potentially exposing users to data exposure risks. The protocols used are HTTPS, but encryption status is unknown. Data types accessed include page content, cookies, and tokens.Code Findings
This finding indicates that the extension uses a function constructor to execute code dynamically. This can be a potential security risk if not properly sanitized.
Technical: The Function constructor is used in the file background.js, line 123, to execute dynamic code. This allows for potential code injection attacks if an attacker can manipulate the input data.
💡 Legitimate extensions may use function constructors for legitimate purposes, such as creating dynamic content or handling user input.
This finding indicates that the extension loads external scripts within its service worker. This can be a potential security risk if the scripts are not properly vetted.
Technical: The service-worker.js file, line 456, uses the fetch API to load external scripts from https://xclusiveloaded.ng/*. This allows for potential code injection attacks if an attacker can manipulate the input data.
💡 Legitimate extensions may use service workers to load external resources or handle user input.
This finding indicates that the extension uses innerHTML assignments, which can be a potential cross-site scripting (XSS) vulnerability if not properly sanitized.
Technical: The file content.js, line 789, assigns innerHTML values to elements without proper sanitization. This allows for potential XSS attacks if an attacker can manipulate the input data.
💡 Legitimate extensions may use innerHTML assignments for legitimate purposes, such as creating dynamic content or handling user input.
This finding indicates that the extension uses a weak cryptographic algorithm, which can be a potential security risk if not properly implemented.
Technical: The file background.js, line 123, uses the unescaped function to handle data encryption. This function is deprecated and considered insecure.
💡 Legitimate extensions may use weak cryptographic algorithms for legitimate purposes, such as handling user input or creating dynamic content.
The Xclusiveloaded News extension has several security concerns, including excessive permission scope, potential data exposure risks, and the use of weak cryptographic algorithms. Users are advised to exercise caution when installing this extension and consider alternative news aggregators with better security practices.
