Is CTCT Extension safe?
CTCT Extension lets any web page relay DLP actions to its local service or native host.
CTCT Extension runs a content script on all sites and accepts page messages labeled DLP_IFRAME_MESSAGE without checking the page origin. It forwards page-supplied DLP actions such as file checks, AIDR checks, notifications, and heartbeats to localhost CTCT endpoints or the com.eagleyun.aidr native host, then posts the callback back to the page.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Store data in your browser
storage
See, disable and uninstall your other extensions, including your security ones
management
Where it sends data
Destinations our analysis observed CTCT Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 127.0.0.1:<port>/aidr/check
CTCT Extension sends data to 127.0.0.1:<port>/aidr/check. No other extension we have analyzed sends data here.
- 127.0.0.1:<port>/ndlp/check
CTCT Extension sends data to 127.0.0.1:<port>/ndlp/check. No other extension we have analyzed sends data here.
- native:com.eagleyun.aidr
CTCT Extension sends data to native:com.eagleyun.aidr. No other extension we have analyzed sends data here.
- ws://127.0.0.1:<port>
CTCT Extension sends data to ws://127.0.0.1:<port>. No other extension we have analyzed sends data here.