Is CRXLauncher safe?

Question

Accepted Answer

CRXLauncher is low risk. CRXLauncher's documented function is to install extensions that are not hosted in the Chrome Web Store. When the crxlauncher.com web page sends an install message containing a downloadUrl, the extension fetches the package from that URL, unzips it into chrome.storage.local, and registers the package's JavaScript as content scripts on every http and https page (chrome.scripting.registerContentScripts with matches ['http://*/*', 'https://*/*']). The package's background script is then executed inside an offscreen document. Our dynamic analysis confirmed this primitive: a test page sending action='install' with a caller-controlled downloadUrl caused the extension to issue OPTIONS+GET requests to that URL and to the iconUrl. This is the extension's stated feature, but it means the JavaScript that ultimately runs on every site you visit is whatever the URL passed to the install message returns at fetch time — there is no Chrome Web Store review, no signature check, and no pinned hash.

Is CRXLauncher safe?

Findings