Is Download Templates safe?

Medium risk

Download Templates fetches HTML from transitschedules.net once per profile and renders it unsanitised on the new tab page.

On the new tab page, the extension requests markup from transitschedules.net, caches it in local storage, and inserts it into the page as raw HTML. This host differs from the extension's own backend, downloadtemplates.net, so the remote server controls what appears there, such as images, frames or tracking pixels. The request exposes the user's IP address to that server.

v2.0.8Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Any web page can request your Coupang session cookies, HttpOnly ones included

Code analysis shows a content script on all sites relays page messages to the extension, which returns Coupang session cookies to the page.

The only gate is that the message came from the page itself.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open a new tab for the first time after installing the extension.

The extension did this

The page asks transitschedules.net for a block of HTML and displays it inside the new tab page.

The request is made only once per profile.

The code that does this

Fetch and render path in the new tab bundle

Readable version

Remote fetch, stored in state

if (!localStorage.getItem("displayedPixelCode")) {  axios.get("https://transitschedules.net/extension/public/pixels")    .then(res => { setPixelHtml(res.data.data); localStorage.setItem("displayedPixelCode", true); })    .catch(console.log);  localStorage.setItem("displayedPixelCode", true);}

Unsanitised render

pixelHtml !== "" ? <div className="customImage" dangerouslySetInnerHTML={{ __html: pixelHtml }} /> : null
What the remote response controls
  • Endpoint host
    transitschedules.net

    A different host from the extension's own backend, downloadtemplates.net.

  • Response field
    data.data

    The string in data.data is inserted into the page as markup.

  • Once-only flag
    displayedPixelCode=true

    localStorage flag stops repeat requests in the same profile.

  • Your IP address
    203.0.113.24 (illustrative)

    Visible to the host on the request, and to any resource the returned markup loads.

Hosts involved
    • transitschedules.net

    Serves the HTML string rendered in the new tab page.

    • downloadtemplates.net

    Extension's own backend; also receives a pixels request on install, result unused.

Limits of this finding

The extension CSP is script-src 'self', so inline scripts and handlers in the returned markup are blocked. Impact is limited to remote-chosen markup such as iframes and images. Current server content was not observed.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Download Templates contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • transitschedules.net

    Download Templates sends data to transitschedules.net. 2 other extensions we have analysed send data here.

  • downloadtemplates.net

    Download Templates sends data to downloadtemplates.net. No other extension we have analysed sends data here.

Updated 15 October 2026nmpipaajfcpnpblnfemfacdgpjmccamn