Is Vebiz Eklenti safe?

Medium risk

Vebiz Eklenti lets pages on vebiz.com.tr open any URL in a new tab and run supplied script code there.

A content script on vebiz.com.tr pages forwards page messages to the background, which opens the requested URL and runs the supplied code in that tab. Neither the URL nor the code is restricted, and the extension holds the all-sites permission, so the script can run on any site and read page content, cookies or form input there. The code shows no data being sent to a fixed server.

Akista Yazılımv1.0Firefox Add-ons
51Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Vebiz Eklenti runs page-supplied code in any tab it opens

Code analysis shows pages on vebiz.com.tr can make the extension open any URL and run page-supplied JavaScript there, with access to every site via the <all_urls> permission.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

A page on a vebiz.com.tr host posts a ConnectUrl message containing a URL and a script string.

The extension did this

The extension opens that URL in a new tab and runs the script string inside it once the page has loaded.

The code that does this

Content script relay and background executor

Readable version

Content script (source is unminified)

vebiz-tools.js
window.addEventListener("message", function (event) {    if (event.source != window) {        return;    }    if (event.data.type && (event.data.type == "ConnectUrl")) {        ConnectUrl(event.data.tabUrl, event.data.script);    }}, false);

Background executor (source is unminified)

background.js
chrome.tabs.create({ "url": request.tabUrl }, function (tab) {    chrome.tabs.onUpdated.addListener(function listener(tabId, info) {        if (tabId === tab.id && info.status === 'complete') {            chrome.tabs.onUpdated.removeListener(listener);            chrome.tabs.executeScript(tabId, { "code": request.script });        }    });});
Fields the page controls
  • tabUrl
    https://mail.example.com/inbox

    Any URL; the extension opens it in a new tab.

  • script
    document.title

    JavaScript source run in that tab by the extension.

  • Permission scope
    <all_urls>

    The manifest grants <all_urls>, so any origin is reachable.

Reproduce it yourself

Posts a ConnectUrl message from a vebiz.com.tr page to check whether the extension opens a tab and runs a benign script.

Requires
  • Firefox with the extension installed
  • A page on *.vebiz.com.tr
vebiz_connecturl_probe.js · js
// Run in the DevTools console of a page on *.vebiz.com.tr with the extension installed.window.postMessage({  type: 'ConnectUrl',  tabUrl: 'https://example.com/',  script: "document.title = 'ConnectUrl probe ran'"}, '*');
How to run it
  1. 1Install the extension.
  2. 2Open a page on a vebiz.com.tr host.
  3. 3Paste the script in the console.
  4. 4A new example.com tab opens and its title changes.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

Updated 15 October 2026amo-2752286