Is Web Lock | App lock for websites safe?

Medium risk

Web Lock | App lock for websites is medium risk. We observed the password lock screen fetch a JSON file from khokonm.github.io and write its url and banner fields into a link and image tag with no sanitization, on every page you configure Web Lock to protect.

khokonv1.34Chrome Web Store
45Risk
Who publishes it

khokon - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
khokon
Website
khokon.dev/contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Lock screen loads a sponsor link and banner from external JSON, unsanitized

We observed the password lock screen fetch a JSON file from khokonm.github.io and write its url and banner fields into a link and image tag with no sanitization, on every page you configure Web Lock to protect.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open a URL you configured Web Lock to protect.

The extension did this

The extension blanks the page with a password form, then fetches a sponsor name, link, and banner from an external JSON file and writes those values in with no sanitization.

The code that does this

sponsor.js writes the fetched url and banner filename straight into the DOM

Readable version

sponsor.js (readable)

assets/js/sponsor.js
chrome.runtime.sendMessage({ sponsors: true }, (response) => {  const nameEl = document.querySelector(".sponsor-name");  const linkEl = document.querySelector(".footer .banner a");  const imgEl = document.querySelector(".footer .banner img");  const sponsors = response.sponsors;  const chosen = sponsors[Math.floor(Math.random() * sponsors.length)];  if (nameEl) {    nameEl.textContent = chosen.name;    linkEl.href = chosen.url;   // written as-is, no validation    imgEl.src = "https://khokonm.github.io/sponsors/banners/" + chosen.banner; // written as-is  }});

background.js message handler (readable)

assets/js/background.js
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {  if (message.installed) {    chrome.runtime.setUninstallURL(baseURL + "/uninstalled?email=" + message.email);    sendResponse({ success: true });  } else if (message.sponsors) {    (async () => {      const sponsorData = await (await fetch("https://khokonm.github.io/sponsors/data.json")).json();      sendResponse(sponsorData); // returned as-is, no field validation    })();    return true; // keep the message channel open for the async response  }});
Captured request
GEThttps://khokonm.github.io/sponsors/data.json

200 OK. JSON body with a sponsors[] array of {name, logo, banner, slogan, url} objects; one entry observed: name "ReadAway", url a Chrome Web Store listing, banner "readaway-banner.png". The lock screen's sponsor name, link, and banner image were populated from this response.

Fields taken from the JSON response and written into the lock screen with no sanitization
  • Sponsor name
    ReadAway

    Text shown next to "sponsored by" on the lock screen.

  • Sponsor link URL
    https://chromewebstore.google.com/detail/read-away/cnlncbpcennfcghdcbghaondmgohbfbl

    Destination when the banner is clicked; assigned to the link's href with no check on scheme or host.

  • Banner image filename
    readaway-banner.png

    Appended to a hardcoded base URL and loaded as the banner image's source.

Where the lock screen's sponsor content comes from
    • khokonm.github.io

    GitHub Pages site tied to the developer's branding; serves the sponsors JSON and banner images shown on locked pages, updatable outside the extension's release process.

What it can do

Permissions this extension asks for, as declared in version 1.34. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Updated 30 September 2026hkknejecoekbededhhhmencnobomannp