Is UAR_SKI_V2P safe?
UAR_SKI_V2P monitors every page you visit and sends the URL to a native application when it detects a marker element.
On every completed page load, on any website, the extension checks the page for a hidden element with the class 'UAR_OrigURL'. If that element is present and contains text, the extension opens a connection to a native helper program installed on the computer (com.skinnovation.uar) and forwards the full URL of the page being visited to it. This happens across all sites with no notice to the user beyond the listing's vague 'URL Auto Redirection' description.
Who publishes itCISOLUTIONS - 2 other listings from the same operator, 1 of them carrying a finding
CISOLUTIONS - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 10k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
URL Auto Redirection sends your page URL to a native app on marked pages
Code analysis shows the extension checks every page you visit for an undisclosed marker element.
When present, it sends that page's full URL to a native program named com.skinnovation.uar installed on the device.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You load any website containing an element with the CSS class UAR_OrigURL and non-empty text.
This can happen on any site, not only the naver.com partner domain named in a filter the code never applies.
It reads that marker, then sends the full URL of the page you're on to a native program called com.skinnovation.uar running outside the browser.
No prompt or disclosure accompanies this beyond the store listing text 'URL Auto Redirection'.
A site filter is declared but never wired to the listener that actually runs
Declared but unused site filter
background.jsvar filter = { url: [ {hostContains: "naver.com"} ]}The listener is registered with no filter argument
background.jschrome.webNavigation.onCompleted.addListener(SendURL_Complete);SendURL_Complete reads the DOM marker result and forwards the URL
background.jsfunction SendURL_Complete(details){ if (details.url == 'about:blank'){ return; } chrome.tabs.sendMessage(details.tabId, "get_contents", function(response) { if (typeof response !== 'undefined'){ if (response !== "nothing"){ // response = response.replace('OrigURL:',''); // response = response.trim() // response = encodeURI(response); // response = response.replace(/\"/g,'%22'); // response = response.replace(/\'/g,'%27'); // console.log(response); // connect(); // sendNativeMessage(response); var urlstring = details.url; //urlstring = urlstring.replace(/\"/g,'%22'); //urlstring = urlstring.replace(/\'/g,'%27'); //urlstring = urlstring.replace(/\#/g,'%23'); console.log(urlstring); connect(); sendNativeMessage(urlstring); } } });}The content script's DOM check for the marker element
contentscript.jschrome.runtime.onMessage.addListener( function(request, sender, sendResponse) { //sendResponse({data: document.getElementsByClassName("UAR_OrigURL"), method: "get_contents"}); //same as innerText var objdom = document.getElementsByClassName("UAR_OrigURL"); if (objdom.length == 0){ sendResponse("nothing"); } else{ sendResponse(objdom[0].innerText); } return true });- Full page URLhttps://partner-shop.example/checkout?ref=aff_9284&session=8f2c1a
The exact web address you're on, query parameters included, is sent to the native program whenever the marker element is present.
- Page marker textOrigURL:https://original-source.example/article/42
Read from the page's DOM to decide whether to send the URL. The text itself is not transmitted, it only acts as an on/off switch.
- com.skinnovation.uar
A native-messaging host installed on the device by the extension's publisher, Skinnovation. Receives the full URL of any marked page outside the browser's network stack.
Injects the marker element the content script looks for, then reloads the page so you can watch the native-messaging call fire.
- Chrome with the extension installed and enabled
- Developer mode enabled on chrome://extensions to view the service worker console
// Run in the DevTools console of any tab, with the extension installed and enabled.document.body.insertAdjacentHTML( 'beforeend', '<div class="UAR_OrigURL">https://example.com/test</div>');location.reload();- 1Open any site, DevTools Console.
- 2Paste and run this script.
- 3After reload, open the extension's service worker console at chrome://extensions.
- 4Confirm connectNative('com.skinnovation.uar') runs and the URL is logged.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.5, which we have not unpacked yet.
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
See every page you navigate to, as you navigate to it
webNavigation
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed UAR_SKI_V2P contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- com.skinnovation.uar (local native messaging host)
UAR_SKI_V2P sends data to com.skinnovation.uar (local native messaging host). Named as a recipient in this extension's own analysis.