Is eimmigration CBP Importer safe?

Medium risk

eimmigration CBP Importer fetches a script from eimmigration.com and runs it in the active tab's page.

When the user selects a travel-history row and clicks Import, the side panel downloads cbpImport.js from the vendor's server and injects it into the active tab's page context, along with jQuery from code.jquery.com. The script is not pinned or integrity-checked, and no check is made on the tab's URL before injection. The injected code receives the row data (name, date of birth, passport number, country) to fill in forms, and the intended target is the CBP I-94 site.

Strong link to a flagged operator: 1 of the 1 other listing from the same operator is rated high or critical for malicious behaviour. Flagged: eimmigration e-Filer (high).

Cerenadev1.0.28.0Chrome Web Store
49Risk
Who publishes it

Cerenade - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Cerenade
Declared legal entity
Cerenade

Same store account

1 other listing published from this account, 1k+ users between them. 1 of them carries a finding.

eimmigration e-Filer1k+High

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

i94.cbp.dhs.gov
Also called by 3 other listings, including Prima.Law

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Side panel runs vendor-hosted script in any active tab with no URL check

Code analysis shows Import fetches a script from eimmigration.com and runs it in the active tab's page context, whatever site that is.

The script is unpinned, so the vendor server decides what executes.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You select a travel-history row in the side panel and click Import.

The extension did this

The extension downloads a script from the vendor's server and runs it inside whichever tab is active.

The tab's address is never checked.

The code that does this

Active tab chosen without a URL gate, then remote script injected

Readable version

Fetch, concatenate, inject into MAIN world

popup.js
const res = await fetch(scriptUrl);if (!res.ok) throw new Error("Failed to fetch script: " + res.statusText);const jsCode = await res.text();// fullCode = fetch/XHR hooks + eoapi mock + ${jsCode} + populateFields(${JSON.stringify(formData)})await chrome.scripting.executeScript({    target: { tabId },    world: "MAIN",    func: (code) => {        const script = document.createElement("script");        script.textContent = code;        (document.head || document.documentElement).appendChild(script);        setTimeout(() => script.remove(), 2000);    },    args: [fullCode],});
Values passed to the fetched script as formData
  • First and last name
    Maria Example

    Taken from the side panel detail fields.

  • Date of birth
    04/17/1988

    Split into month, day and year.

  • Travel document number
    X1234567 (illustrative)

    From the selected travel-history row.

  • Issuing country
    Brazil (illustrative)

    From the selected travel-history row.

Hosts that supply code executed in the page
    • www.eimmigration.com

    Serves cbpImport.js, run in the page's JS context with the row data.

    • code.jquery.com

    Serves jquery-3.6.0.min.js, added to the page when jQuery is absent.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.28.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on eimmigration.com

    https://eimmigration.com/*

  • Read and change your data on www.myecms.com

    https://www.myecms.com/*

  • Read and change your data on i94.cbp.dhs.gov

    https://i94.cbp.dhs.gov/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Show a panel beside the page

    sidePanel

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed eimmigration CBP Importer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.eimmigration.com

    eimmigration CBP Importer sends data to www.eimmigration.com. One other extension we have analysed sends data here.

Updated 15 October 2026lbihfogocfdonffmfpiecajlfjmioemk