Is Dice Thrower safe?
Dice Thrower fetches a remote HTML snippet from cameronsamuels.com and injects it into the popup via innerHTML on every open.
Each time the popup loads and the browser is online, the extension requests an HTML file from cameronsamuels.com/dice/snippet.html and inserts the raw response text into the page using innerHTML. The only check is whether the response contains the string 'dice-thrower-snippet'; any response passing that test is rendered as HTML. Chrome's extension Content Security Policy blocks inline script execution, but injected elements such as iframes, forms, and anchor tags with attacker-controlled attributes are rendered and interactive.
Who publishes itCameron Samuels - 1 other listing from the same operator, none carrying a finding
Cameron Samuels - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 40k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup Renders Remote HTML From cameronsamuels.com
Dice Thrower's popup fetches an HTML snippet from cameronsamuels.com and inserts any response containing "dice-thrower-snippet" directly into its HTML.
Chrome blocks inline scripts, but links, forms and frames can still render there.
What actually happens
You open the Dice Thrower popup while the browser is online.
The popup page loads its JavaScript as soon as the extension window opens.
The extension requests an HTML snippet and renders a passing response inside the popup.
The response only has to contain the marker text "dice-thrower-snippet" before it is assigned to the popup's HTML container.
Captured request
The response text is passed to addSnippet(response); verification evidence records the request URL and render sink, but no response body was recorded for this claim.
Remote snippet controls visible popup content
- Remote HTML sourcehttps://cameronsamuels.com/dice/snippet.html
This host supplies content that can appear inside the extension window you opened.
- Required markerdice-thrower-snippet
Any response containing this marker passes the extension's check before rendering.
- Render location#snippet
The passing HTML appears in the popup page rather than in a normal web tab.
- Render methodinnerHTML
The returned HTML is inserted as page markup, so visible elements from the response can be shown in the popup.
The code that does this
The popup fetches a remote snippet and assigns it to innerHTML
Deobfuscated popup script; no obfuscation was present
app/script.js// HTML Snippets - No CSS or JS is included in snippets (GET request for HTML)if (window.navigator.onLine) { function addSnippet(response) { if (response.includes("dice-thrower-snippet")) document.querySelector("#snippet").innerHTML = response; else document.body.style.paddingBottom = "32px"; } fetch("https://cameronsamuels.com/dice/snippet.html") .then(response => response.text()) .then(response => addSnippet(response));} else document.body.style.paddingBottom = "32px";Deobfuscated popup container; identical to shipped HTML
app/index.html<div id="snippet"></div><script src="script.js"></script>Deobfuscated manifest; identical host permission
manifest.json"host_permissions": [ "https://cameronsamuels.com/"],"offline_enabled": trueExternal host involved in the popup render path
- cameronsamuels.com
Supplies the HTML snippet that the popup requests and may render inside the extension UI.
What it can do
Permissions this extension asks for, as declared in version 4.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on cameronsamuels.com
https://cameronsamuels.com/