Is online reading bookcase safe?
Online Reading Bookcase embeds a vendor-hosted iframe on every page and sends it the page's URL and title.
The extension injects a widget from onlinereadingbookcase.com into every http/https page. When the widget requests it, the extension sends the page's full URL and title along with a persistent user ID and API key. The widget can also ask the extension to open or navigate tabs and windows, and any page script can read the extension's persistent user ID.
Who publishes itNo other listings under this identity
No other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension sends every page's URL and title to a vendor widget iframe on request
Code analysis shows a widget iframe from onlinereadingbookcase.com can ask the content script for the current page's URL and title, and receives both.
This runs on all http and https pages.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open any web page over http or https.
The extension embeds a vendor iframe and answers its request with the page address and title.
The iframe decides when to ask.
- Page URLhttps://example.com/account/orders?id=1842
The full address of the page you are viewing.
- Page titleYour orders - Example Shop
The title shown in your browser tab.
Metadata-request handler
Reply to metadata-request
content.js if (!messengerInitialized) return; return metadataRequestMessage.subscribe(() => { metadataMessage.publish({ url: window.location.href, title: document.title }); }); }, [messengerInitialized]);- resources.onlinereadingbookcase.com
Hosts the widget iframe that receives the URL and title; its code is not in the package.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Vendor iframe can make the extension open tabs and navigate pages to any URL
Code analysis shows messages from a vendor-hosted iframe are forwarded to the service worker, which opens tabs or windows and navigates the current tab using caller-supplied properties, with no URL allowlist.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
The vendor-hosted iframe sends an open-page or update-page message.
The extension opens a tab or window, or navigates your current tab, to the address supplied.
No allowlist is applied to the URL.
Relay and dispatch
Content script relay
content.js if (isPageExtensionMessage(message)) { this.sendRuntimeMessage(message); return; }Service worker dispatch
service-worker.js switch (message.name) { case "open-page": await this.openPage(message.params); break; case "update-page": await this.updateCurrentTarget(message.params, messageSender); break; } }Caller-supplied properties reach the tabs API
Create
service-worker.js if (message.kind === "tab") { const { kind: _kind2, id: _id2, additionalData: _additionalData2, ...createProperties } = message; return this.browser.tabs.create(createProperties); }Update
service-worker.js if (message.kind === "tab") { const tabId = messageSender.tab?.id; if (tabId === undefined) { return; } const { kind: _kind2, ...updateProperties } = message; await this.browser.tabs.update(tabId, updateProperties); return;- urlhttps://example.com/landing
Sets the address the new or current tab goes to.
- kindtab
Chooses whether a tab or a window is affected.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed online reading bookcase contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- resources.onlinereadingbookcase.com
online reading bookcase sends data to resources.onlinereadingbookcase.com. No other extension we have analysed sends data here.
- www.onlinereadingbookcase.com
online reading bookcase sends data to www.onlinereadingbookcase.com. No other extension we have analysed sends data here.