Is L.O.C safe?

Question

Is L.O.C safe?

Accepted Answer

L.O.C is critical risk. Our dynamic analysis confirmed that the extension accepts commands from pages at loc.dev and lnmai.com and immediately forwards them as credentialed requests to Facebook's API endpoints, using your active Facebook session. We sent a test 'graphql' command from a loc.dev page and observed the extension's background service worker POST to https://www.facebook.com/api/graphql/ with credentials:include — meaning your Facebook cookies were attached. Any page running at those domains can instruct the extension to perform GraphQL queries, batch queries, and arbitrary POSTs to Facebook on your behalf, with no confirmation prompt shown to you. When the L.O.C extension installs, its service worker reads your Facebook c_user session cookie and transmits it alongside the extension's full manifest object to https://loc.dev/rtx3070 via a POST request. Dynamic analysis observed this POST request firing with an HTTP 200 response immediately on install. A second code path stores the c_user cookie value in chrome.storage.local and opens a tab to loc.dev/dashboard. The network POST is gated by an extension-ID fingerprint check, but that gate did not block the request in test sessions where the installed extension ID did not match the hardcoded whitelist. 2 further issues were flagged.

Is L.O.C safe?

Findings