Is eimmigration e-Filer safe?

High risk

eimmigration e-Filer fetches backend-supplied JavaScript and runs it in the active tab.

When you use the popup, the extension builds a request to eimmigration's scheduled-forms API and downloads JavaScript for the selected case form. It then runs that downloaded script in the current active tab without first checking that the tab is an intended immigration-filing site, so the script can interact with the page content and form fields on that tab.

Cerenadev1.2.0.0Chrome Web Store
72Risk
Who publishes it

Cerenade - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Cerenade
Declared legal entity
Cerenade
Registered address
9800 S La Cienega Blvd, Suite 411, Inglewood, CA 90301-4440, US
Registered contact
Jennifer Herrera

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote form script runs in the active tab

Clicking Populate makes eimmigration e-Filer fetch JavaScript for the chosen form and inject it into whichever tab is active, not the filing site.

It never checks the tab URL against the manifest's filing origins before running that script.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You click Populate after choosing a scheduled immigration form.

The selected form ID and tenant URL are already saved in extension storage.

The extension did this

The extension downloads JavaScript for that form and runs it in the current active tab.

The code path passes only the active tab ID to the injection function, with no active-tab URL comparison before execution.

Page data available to the downloaded script
  • Current page address
    https://example.com/account/settings

    The script runs on the page you have active, so that page address is available to the inserted code.

  • Form fields on the page
    Applicant name: Maria Alvarez

    Fields already present on the active page can be read or changed by code that runs in the page context.

  • Page content
    Account overview and application status text

    Visible text and HTML on the active page are reachable from the inserted script.

Captured request
GEThttps://www.eimmigration.com/{WebsiteName}/api/Services/eFiler/scheduledForms/{caseFormID}/Script?v={Date.now()}

JavaScript text is read with res.text() and passed into chrome.scripting.executeScript.

Headers
Authorization
Bearer <redacted>
The code that does this

The popup chooses the active tab, fetches backend JavaScript, and injects it into the page

Readable version

Readable execution path

popup.js
async function populateSelectedFormIntoCurrentTab() {    const scriptUrl = await buildScheduledFormScriptUrlFromStorage();    if (!scriptUrl) {        return;    }    const [activeTab] = await chrome.tabs.query({ active: true, currentWindow: true });    if (!activeTab || !activeTab.id) {        throw new Error("No active tab found");    }    await fetchAndRunFormScript(activeTab.id, scriptUrl);}

Readable injection logic

popup.js
async function fetchAndRunFormScript(tabId, scriptUrl) {    const { token } = await chrome.storage.local.get("token");    if (!token) {        throw new Error("No auth token found");    }    const response = await fetch(scriptUrl + "?v=" + Date.now(), {        headers: { Authorization: `Bearer ${token}` }    });    if (!response.ok) {        throw new Error(`HTTP ${response.status}`);    }    const downloadedJavaScript = await response.text();    await chrome.scripting.executeScript({        target: { tabId },        world: "MAIN",        func: (code) => {            const previous = document.getElementById("remoteInjectedScript");            if (previous) {                previous.remove();            }            const script = document.createElement("script");            script.id = "remoteInjectedScript";            script.textContent = `(function(detectEfilingSection, eFile){                try {                    ${code}                    if (typeof detectEfilingSection === "function" && typeof eFile === "function") {                        const section = detectEfilingSection();                        eFile(section).catch(err => console.error("Error in eFile:", err));                    }                } catch(err) {                    console.error("Injected script error:", err);                }            })(window.detectEfilingSection, window.eFile);`;            document.documentElement.appendChild(script);            script.remove();        },        args: [downloadedJavaScript]    });}
Network destination used to retrieve the executable form script
    • www.eimmigration.com

    Receives the authenticated scheduled-form Script request and returns JavaScript that the extension executes in the active tab.

What it can do

Permissions this extension asks for, as declared in version 1.2.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on ceac.state.gov

    https://ceac.state.gov/*

  • Read and change your data on my.uscis.gov

    https://my.uscis.gov/* and 1 more

  • Read and change your data on eimmigration.com

    https://eimmigration.com/*

  • Read and change your data on first.uscis.gov

    https://first.uscis.gov/*

  • Read and change your data on www.eimmigration.com

    https://www.eimmigration.com/*

  • Read and change your data on www.myecms.com

    https://www.myecms.com/*

  • Read and change your data on flag.dol.gov

    https://flag.dol.gov/*

  • Read and change your data on api-int.uscis.gov

    https://api-int.uscis.gov/*

  • Read and change your data on api.uscis.gov

    https://api.uscis.gov/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Show a panel beside the page

    sidePanel

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed eimmigration e-Filer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.eimmigration.com

    eimmigration e-Filer sends data to www.eimmigration.com. No other extension we have analysed sends data here.

Updated 30 September 2026efhimicngeepgjklnmpcjbeidhblchpg