Is Color Picker safe?
Color Picker loads HTML from linangdata.com on every popup open and inserts it into the popup page.
Each time the popup opens, the extension requests link and banner HTML from three linangdata.com endpoints and injects it into the popup without sanitising it. Clicking the injected links opens the server-chosen URLs in new tabs. The same code appears in the developer's sibling Grammar Checker extension.
Who publishes itLinangData - 18 other listings from the same operator, 3 of them carrying a finding
LinangData - 18 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 216k+ users between them. 3 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Color Picker popup injects server-supplied HTML from linangdata.com each open
Code analysis shows the popup fetches three HTML fragments from linangdata.com each time it opens and inserts them into the page unsanitised.
Links in them open in new tabs.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You click the Color Picker icon to open its popup.
The popup downloads HTML from linangdata.com and places it in the page as markup.
Links inside that HTML open in new tabs when clicked.
Popup startup code that fetches and injects remote HTML
Same source; the file ships unminified
app.js$("#links").html(data);$("#banner-top").html(data).removeClass('hidden');$("#banner-bottom").html(data).removeClass('hidden');- Links endpointhttps://linangdata.com/servedcontent/dynamiclinks.php?source=color-picker
Returns the HTML placed in the links menu.
- Top banner endpointhttps://linangdata.com/servedcontent/bannertop.php?source=color-picker
Returns HTML shown above the picker.
- Bottom banner endpointhttps://linangdata.com/servedcontent/bannerbottom.php?source=color-picker
Returns HTML shown below the picker.
- Link click handlerchrome.tabs.create({ url: href })
Opens the href of any served .navopentab link in a new tab.
- linangdata.com
Developer-operated server; its responses are inserted into the popup and decide which URLs open.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 2.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Act on the current tab, but only after you click the extension
activeTab
Add items to the right-click menu
contextMenus
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Color Picker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- linangdata.comwidely used
Color Picker sends data to linangdata.com. A widely used service: 28 other extensions we have analysed send data here.