Is QR Code Reader safe?

Medium risk

QR Code Reader is medium risk. Each popup open, the extension requests JSON config from dsnetx.web.app. The server can return arbitrary HTML, rendered via jQuery notify or alert(), unsanitized. A fallback fires if the primary fails; version is sent as a URL parameter.

QRExtv2.0.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Extension fetches remotely-controlled notification config on every popup open

Each popup open, the extension requests JSON config from dsnetx.web.app.

The server can return arbitrary HTML, rendered via jQuery notify or alert(), unsanitized.

A fallback fires if the primary fails; version is sent as a URL parameter.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the QR Code Reader popup.

No QR code scanning action is required, the fetch fires on popup load.

The extension did this

The extension fetches a notification config from a remote server and renders any returned HTML content directly in the popup.

The response is parsed as JSON and displayed via jQuery notify or browser alert() with no validation of content or server identity.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://dsnetx.web.app/apps/firelinks/msg.json?ref=QrExt04-CH-v203&r=0.7275226811959352
HTTP 200 OK, {"global":{"exclude":[]},"private":[]}, live endpoint confirmed; currently empty message set but operator can update at any time.
03EvidenceCODE COMPARE
The code that does this

Notification fetch and render logic in scripts/shared.js

What it actually does
Endpoint list and fetch (readable)
const NOTIFICATION_ENDPOINTS = [
  "https://dsnetx.web.app/apps/firelinks/msg.json",
  "https://dsnet.bitbucket.io/apps/ext/msg/msg.json"
];

function fetchNotificationConfig() {
  const url = `${NOTIFICATION_ENDPOINTS[endpointIndex]}?ref=${APP_ID}&r=${Math.random()}`;
  fetch(url, { cache: "no-store" })
    .then(res => res.json())
    .then(data => {
      if (isEmpty(data)) {
        endpointIndex++;
        if (endpointIndex < NOTIFICATION_ENDPOINTS.length) setTimeout(fetchNotificationConfig, 100);
      } else {
        endpointIndex = 0;
        processMessages(data);
      }
    })
    .catch(err => { /* retry fallback */ });
}
Display unsanitized remote content (readable)
function displayNotification(msg) {
  const type = msg.typeNotif || "WEBUI";
  if (type === "WEBALERT") {
    alert(`${msg.title}: ${msg.msg}`);
  } else {
    // Renders msg.msg as HTML in the popup via jQuery notify
    // No sanitization, no signature check
    $.notify(msg.msg, { autoHide: !msg.autoclose, style: "bootstrap-html" });
  }
}
04EvidenceTHIRD PARTY LIST
Remote endpoints contacted on every popup open
  • dsnetx.web.app

    Primary notification config endpoint hosted on Google Firebase. Returns JSON controlling what messages are shown to users. Developer-operated.

  • dsnet.bitbucket.io

    Fallback notification config endpoint hosted on Atlassian Bitbucket Pages. Queried if the primary Firebase endpoint fails.

05EvidenceTEMPORAL PATTERN
When this fires
On every browser startup

Config fetch fires automatically every time the popup opens, no user interaction beyond opening the extension is required. Time-gating restricts display to hours 7-22 local time, but the network request itself occurs regardless of time.

Updated 10 September 2026likadllkkidlligfcdhfnnbkjigdkmci