Is Url Shortener for Google Chrome™ safe?

High risk

URL Shortener is high risk. Opening the popup fetches a notification config from dsnetx.web.app. Any message in the response is inserted into the popup as raw HTML with no sanitization, so a malicious response could run arbitrary HTML there.…

ExtAdminv2.0.1Chrome Web Store
75Risk
Who publishes it

ExtAdmin - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ExtAdmin
Registered address
620 Park View Dr, 112, Santa Clara, CA 95054, United States
Registered contact
Aruna Janapati
Website
ggle.io/QRExt3Help

Same store account

2 other listings published from this account, 209k+ users between them, none of them carrying a finding.

QR Code200k+LowQR Code Reader9k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup fetches remote HTML from dsnetx.web.app and renders it unsanitized

Opening the popup fetches a notification config from dsnetx.web.app.

Any message in the response is inserted into the popup as raw HTML with no sanitization, so a malicious response could run arbitrary HTML there.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup.

The popup initializes and, after a 1500 ms delay, calls the notification loader.

The extension did this

The extension fetches a JSON config from a remote server and injects any returned HTML into the popup without sanitization.

If the server's 'msg' field contains HTML tags, they are rendered directly in the popup DOM via $.notify() with the bootstrap-html style template.

Captured request
GEThttps://dsnetx.web.app/apps/firelinks/msg.json?ref=QrExt03-v201&r=0.7423819542

Returns JSON with 'global' and 'private' message arrays. Each message object may include a 'msg' field containing arbitrary HTML, a 'show' flag, and targeting controls.

The code that does this

HTML injection via bootstrap-html notify template

Readable version

What the data-notify-html template does

scripts/popup.js
// The 'bootstrap-html' style template uses data-notify-html,// which causes the notify library to treat t.msg as innerHTML// rather than text content — no escaping, no sanitization.//// A server-supplied payload like://   { "show": true, "msg": "<img src=x onerror=alert(1)>" }// would execute the onerror handler inside the extension popup context.
Remote endpoints that supply the HTML payload
    • dsnetx.web.app

    Primary notification config endpoint. Operator-controlled Firebase Hosting; supplies the msg.json payload injected into the popup.

    • dsnet.bitbucket.io

    Fallback notification config endpoint. Used if dsnetx.web.app fails. Also operator-controlled.

Popup sends extension version fingerprint to remote server on every open

Each time you open the popup, a request goes to dsnetx.web.app carrying a version identifier (e.g.

QrExt03-v201) as a query parameter, letting the operator correlate requests from this extension version across installs.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup.

The popup initializes and schedules the notification loader after 1500 ms.

The extension did this

The extension sends a request to dsnetx.web.app that includes your extension version as a ?ref= query parameter.

The parameter value QrExt03-v201 (where '201' is the version with dots removed) is consistent across all users of the same version.

Captured request
GEThttps://dsnetx.web.app/apps/firelinks/msg.json?ref=QrExt03-v201&r=0.3817452963

Returns JSON notification config. The ref= parameter identifies the extension version; the server can segment or target responses by version.

Data included in the notification config request
  • Extension version identifier
    QrExt03-v201

    A code combining the extension name prefix and version, sent on every popup open, that lets the server identify which version is installed.

  • Cache-bust nonce
    0.7423819542

    A random number appended to prevent the browser from caching the response. Not personally identifying.

The code that does this

APP_ID construction and use in the fetch URL

Readable version

Readable equivalent

scripts/popup.js
// APP_ID is computed once at module load:// For version 2.0.1 → 'QrExt03-v201'const APP_ID = 'QrExt03-v' + chrome.runtime.getManifest().version.replace(/\./g, '');// On every popup open (after 1500ms), fetch with APP_ID as ?ref=:const url = 'https://dsnetx.web.app/apps/firelinks/msg.json'  + '?ref=' + APP_ID  + '&r=' + Math.random();  // cache-bustfetch(url, { cache: 'no-store' });

What it can do

Permissions this extension asks for, as declared in version 2.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • See the address and title of every tab you have open

    tabs

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

Updated 30 September 2026jabkcacglannajohdmbgiejideejeeln