Is 易解析 - 图片/视频/音乐 网页嗅探神器 safe?

Medium risk

易解析 - 图片/视频/音乐 网页嗅探神器 is medium risk. Code analysis shows the extension fetches a per-site script from its own server and runs it with full access to your page, not in a sandbox.

chathub807v1.1.5Chrome Web Store
52Risk
Who publishes it

chathub807 - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
chathub807

Same store account

1 other listing published from this account, 6k+ users between them, none of them carrying a finding.

SiteData - Traffic Checker/Ads Transparency/SEO analyzer6k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

This extension runs vendor-sent scripts as your page's own JavaScript

Code analysis shows the extension fetches a per-site script from its own server and runs it with full access to your page, not in a sandbox.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You visit a page whose hostname the vendor's server has configured with a script.

The extension did this

The extension compiles that server-supplied script and runs it with the same access as the page's own JavaScript, not in an isolated sandbox.

The interpreter's execution context is set to the real browser window before the script runs.

The code that does this

The interpreter's global scope is repointed at the real page window

Readable version

Library default

js/chrome-inject-eval.js
// The bundled eval5 interpreter ships with an isolated default context:Interpreter.global = Object.create(null); // no window, no DOM, no cookies

Extension override

js/content.js
// The extension replaces that default before creating its interpreter instance:const { Interpreter } = evalCore.evalModule;Interpreter.global = window; // real page window: DOM, cookies, fetch, everythingconst interpreter = new Interpreter();
What the remote config controls per hostname
  • Script to run on this site
    window.aiparser2img = function(buffer) { /* ... */ }

    Arbitrary JavaScript the server sends is compiled and executed with page-level access whenever you're on a matching host.

  • Which sites this applies to
    example.com

    A substring match against your page's hostname decides whether a script runs; the server, not the extension, controls the site list.

  • Data passed into the script
    up to 500 buffered request/response entries

    The functions the script defines are called with the extension's buffer of your recent cross-site AJAX requests and responses.

Where the per-site scripts come from
    • 51save.savev.cc

    Vendor's own config endpoint. Returns the hostname-keyed JSON that names which sites get a script and what that script contains.

Reproduce it yourself

Fetches the live per-hostname script config directly from the vendor's endpoint so you can see what runs on a given site without installing the extension.

Requires
  • Node.js 18+
fetch-51save-config.js · js
// node fetch-51save-config.js <version> <hostname-substring-to-check>const https = require('https');const crypto = require('crypto');const version = process.argv[2] || '1.1.5';const clientId = crypto.randomUUID();const url = `https://51save.savev.cc/v1/51save/common/jsonForJs?version=${version}&clientId=${clientId}`;https.get(url, (res) => {  let data = '';  res.on('data', (chunk) => { data += chunk; });  res.on('end', () => {    const config = JSON.parse(data);    const keys = Object.keys(config);    console.log(`Config returned ${keys.length} hostname key(s):`);    for (const key of keys) {      console.log(`\n--- ${key} ---`);      console.log(config[key].script || '(no script field)');    }  });}).on('error', (e) => console.error('Request failed:', e.message));
How to run it
  1. 1Run `node fetch-51save-config.js` (optionally pass the extension version as arg 1).
  2. 2Read the printed script for each hostname key.
  3. 3Search the output for a substring of any site you visit to see if it has a configured script.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/* and 1 more

  • Read and change your data on every secure site you visit

    https://*/*

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • Watch every request your browser makes

    webRequest

  • Add items to the right-click menu

    contextMenus

  • Act on the current tab, but only after you click the extension

    activeTab

Updated 30 September 2026gcpmionijkkgeohemkebnkjnblhmpjck