Is Dice Thrower safe?
Dice Thrower fetches a remote HTML snippet from cameronsamuels.com and injects it into the popup via innerHTML on every open.
Each time the popup loads and the browser is online, the extension requests an HTML file from cameronsamuels.com/dice/snippet.html and inserts the raw response text into the page using innerHTML. The only check is whether the response contains the string 'dice-thrower-snippet'; any response passing that test is rendered as HTML. Chrome's extension Content Security Policy blocks inline script execution, but injected elements such as iframes, forms, and anchor tags with attacker-controlled attributes are rendered and interactive.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup Renders Remote HTML From cameronsamuels.com
Dice Thrower's popup fetches an HTML snippet from cameronsamuels.com and inserts any response containing "dice-thrower-snippet" directly into its HTML.
Chrome blocks inline scripts, but links, forms and frames can still render there.
You open the Dice Thrower popup while the browser is online.
The popup page loads its JavaScript as soon as the extension window opens.
The extension requests an HTML snippet and renders a passing response inside the popup.
The response only has to contain the marker text "dice-thrower-snippet" before it is assigned to the popup's HTML container.
| Field | Value | Why it matters | |
|---|---|---|---|
Remote HTML source | https://cameronsamuels.com/dice/snippet.html | This host supplies content that can appear inside the extension window you opened. | |
Required marker | dice-thrower-snippet | Any response containing this marker passes the extension's check before rendering. | |
Render location | #snippet | The passing HTML appears in the popup page rather than in a normal web tab. | |
Render method | innerHTML | The returned HTML is inserted as page markup, so visible elements from the response can be shown in the popup. |
The popup fetches a remote snippet and assigns it to innerHTML
// HTML Snippets - No CSS or JS is included in snippets (GET request for HTML)
if (window.navigator.onLine) {
function addSnippet(response) {
if (response.includes("dice-thrower-snippet"))
document.querySelector("#snippet").innerHTML = response;
else document.body.style.paddingBottom = "32px";
}
fetch("https://cameronsamuels.com/dice/snippet.html")
.then(response => response.text())
.then(response => addSnippet(response));
} else document.body.style.paddingBottom = "32px";<div id="snippet"></div> <script src="script.js"></script>
"host_permissions": [ "https://cameronsamuels.com/" ], "offline_enabled": true
- cameronsamuels.com
Supplies the HTML snippet that the popup requests and may render inside the extension UI.