Is TextRecruit Extension safe?

High risk

TextRecruit is high risk. When you open the TextRecruit sidebar, the extension loads the app at app.textrecruit.com/ext-react in an iframe. It receives the page URL and DOM content via postMessage, so hosted-app changes can alter sidebar behavior without an update.…

ICIMS, Inc.v4.0.6Chrome Web Store
73Risk
Who publishes it

iCIMS, Inc. - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ICIMS, Inc.
Declared legal entity
iCIMS, Inc.
Registered address
101 Crawfords Corner Road, Suite 3-100, Holmdel, NJ 07733, US
Registered contact
iCIMS, Inc.
Website
textrecruit.zendesk.com/hc/en-us

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

iCIMS Browser Extension1k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

TextRecruit loads a remote sidebar app on candidate pages.

When you open the TextRecruit sidebar, the extension loads the app at app.textrecruit.com/ext-react in an iframe.

It receives the page URL and DOM content via postMessage, so hosted-app changes can alter sidebar behavior without an update.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The user opens the TextRecruit sidebar.

The extension did this

The extension injects an iframe and loads a remote TextRecruit application that receives page URL and DOM content.

Captured request
GEThttps://app.textrecruit.com/ext-react
Fields in the request
  • Current page URL
    https://example.com/candidate/123 (illustrative)

    Shows which page the sidebar was opened on.

  • Page DOM content
    <div class="profile">Candidate details</div> (illustrative)

    Includes page text and markup available to the extension on the current page.

Observation

Observed during dynamic analysis: the extension loaded the TextRecruit iframe and forwarded TextRecruitData messages to it.

Candidate PII sent to TextRecruit iframe from ATS pages

On supported applicant-tracking-system pages, clicking a phone-number highlight makes TextRecruit read candidate details from the page and send them, with the page URL, to its iframe at app.textrecruit.com/ext-react.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Clicks a phone-number highlight on a supported ATS candidate page

The extension did this

Reads candidate details and the page URL from the DOM, then posts that data to the TextRecruit iframe

Captured request
POSTapp.textrecruit.com/ext-react
Fields in the request
  • Candidate page content
    Jane Candidate, +1 555-0100, source ID 12345 (illustrative)

    DOM content can include candidate names, phone numbers, clicked element HTML, and ATS source IDs from the profile page.

  • Current page URL
    https://ats.example.com/candidates/12345 (illustrative)

    The URL identifies the ATS page where the candidate interaction occurred.

What it can do

Permissions this extension asks for, as declared in version 4.0.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

Updated 30 September 2026hohjiogaaddpcpakfaegfacbaggphald