Is Hulu 同時字幕で英語学習 safe?
Hulu 同時字幕で英語学習 is high risk. The shipped Hulu page script checks a GCS manifest on Hulu Japan pages. If the flag is set, it loads and runs storage.googleapis.com/niko-extension/hulu/mv3/content_inserted.js in the page, gaining access to its content, URL, and storage.
Who publishes itniko - 2 other listings from the same operator, 1 of them carrying a finding
niko - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 40k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote Update JavaScript on Hulu Pages
The shipped Hulu page script checks a GCS manifest on Hulu Japan pages.
If the flag is set, it loads and runs storage.googleapis.com/niko-extension/hulu/mv3/content_inserted.js in the page, gaining access to its content, URL, and storage.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open a Hulu Japan page while the extension is active.
The extension checks a remote manifest and, when the manifest enables the update, loads a JavaScript file from Google Cloud Storage into that page.
The shipped code expects a JSON response and branches on the response's update field.
- Hulu page contentSubtitle text and player controls on a Hulu watch page (illustrative)
The loaded script runs on the Hulu page, so it can read visible page elements that ordinary Hulu page JavaScript can read.
- Hulu page URLhttps://www.hulu.jp/watch/60123456 (illustrative)
The page address can reveal which Hulu page or title is open.
- Hulu page storageHDSFLEGSID in Hulu localStorage (illustrative)
The script can use storage that belongs to the Hulu page origin, including extension-created records saved there.
Manifest-controlled remote script injection
Content script injects the page-world bundle
content.jswindow.addEventListener("DOMContentLoaded", () => { const script = document.createElement("script"); script.src = chrome.runtime.getURL("content_inserted.js"); script.onload = function () { this.remove(); }; (document.head || document.documentElement).appendChild(script);});Page-world bundle checks Google Cloud Storage and appends the remote file
content_inserted.jsconst emergencyScriptId = `${APP_NAME}GoogleCloudInsertMinJs`;new Promise((resolve, reject) => { if (document.getElementById(emergencyScriptId)) { console.log("Emergency update content_inserted.js already exists"); return resolve(false); } new Promise((resolveManifest, rejectManifest) => { const xhr = new XMLHttpRequest(); xhr.responseType = "json"; xhr.open("GET", "https://storage.googleapis.com/niko-extension/hulu/mv3/manifest.json", true); xhr.timeout = 10000; xhr.onload = () => xhr.status === 200 ? resolveManifest(xhr.response) : rejectManifest(); xhr.onerror = () => rejectManifest(); xhr.ontimeout = () => rejectManifest(); xhr.send(null); }) .then((manifest) => manifest.update ? resolve(true) : resolve(false)) .catch(() => resolve(false));}).then((enabled) => { if (!enabled) { return startBundledExtensionCode(); } return new Promise((resolve, reject) => { const src = "https://storage.googleapis.com/niko-extension/hulu/mv3/content_inserted.js"; const script = document.createElement("script"); script.id = emergencyScriptId; script.onload = () => resolve(); script.onerror = () => reject(); script.setAttribute("type", "text/javascript"); script.setAttribute("src", src); (document.head || document.documentElement).appendChild(script); }).catch(() => startBundledExtensionCode());});- storage.googleapis.com
Hosts the niko-extension/hulu/mv3 manifest and the JavaScript file loaded when the manifest enables the update.
What it can do
Permissions this extension asks for, as declared in version 2.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on www.hulu.jp
https://www.hulu.jp/
Store data in your browser
storage