Is Vocabulary builder safe?
Vocabulary builder injects a remote vocabulary.live sidebar into any site, giving it read/write access to the page and its local storage.
Clicking the toolbar icon injects a sidebar containing a live iframe from vocabulary.live into the current tab, on any site. Content served from that iframe can read text and HTML from any element on the page, read, write, and clear the page's local storage, fill in and click page elements, and receive the page URL, title, and every text selection you make while the sidebar is open. Because the iframe's code is loaded live from vocabulary.live rather than shipped with the extension, its behavior can change at any time without a Chrome Web Store update.
Who publishes itPrius Lab - 6 other listings from the same operator, 1 of them carrying a finding
Prius Lab - 6 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 28k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Vocabulary.live sidebar bridge reads and edits any active tab's DOM and storage
Code analysis shows clicking the toolbar icon injects a vocabulary.live iframe into whatever page has focus, wiring a message bridge that can read page content and read, write, or clear that page's localStorage.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Static analysis
You click the toolbar icon while a page is open.
This works on any site; the sidebar is not limited to vocabulary.live.
The extension injects a bridge script into that page and opens a sidebar loaded from vocabulary.live.
The bridge listens for commands sent by the vocabulary.live iframe and runs them against the page you were on.
Toolbar click injects the bridge into the active tab, not just vocabulary.live
Equivalent, annotated
background.js// No site check here: chrome.tabs.query({currentWindow:true, active:true})// returns whatever tab currently has focus.chrome.action.onClicked.addListener(() => { const activeTab = getCurrentActiveTab(); // any origin injectFile(activeTab, "files/modal.js"); // installs the message bridge injectFile(activeTab, "files/modal.css"); createSidebarIframe(activeTab, "https://vocabulary.live/extantion");});- Page element text/HTMLelementText { selector: "#checkout-summary" }
Any element on the active page can be read by CSS selector, chosen by vocabulary.live's own script, not the extension bundle.
- Active page localStoragereadFromLocalStorage { key: "session_token" }
The bridge can read, write, or clear window.localStorage for whatever site the sidebar is open on.
- Form fill / clickfillInput { selector: "#email", value: "..." }
The bridge can set an input's value or click any element by selector.
- Page URL and titletabInfo -> { url: "https://example.com/account", title: "My Account" }
Sent automatically on every click or navigation while the sidebar is open.
- Selected textselectionchange -> { text: "quarterly revenue rose 12%" }
Every text selection on the page is posted to the iframe automatically.
The bridge's command dispatch table and its origin check
What the origin check does and does not gate
files/modal.js// The check DOES restrict senders to content actually loaded inside// the vocabulary.live/extantion iframe -- an arbitrary third-party// page cannot post commands here.// It does NOT restrict which page the bridge is running IN, or which// page's DOM/localStorage the resulting command reads or writes:// that is whatever tab was active when the toolbar icon was clicked.vocabulary.live/extantion's own script loads live, not shipped in the bundle, so which commands it actually issues, and to which sites, is not confirmable from static analysis alone. That behavior can change without a new extension version.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Vocabulary builder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- vocabulary.live
Vocabulary builder sends data to vocabulary.live. 3 other extensions we have analyzed send data here.