Is World Time safe?
World Time loads HTML and links from linangdata.com into its popup and opens server-supplied links in new tabs.
When the popup opens, the extension requests three pages from linangdata.com and inserts the returned markup directly into the popup as links and banners. Links marked as tab-openers open in a new browser tab at whatever address the server provides. The requests carry a source label and a timestamp-based identifier.
Who publishes itLinangData - 18 other listings from the same operator, 4 of them carrying a finding
LinangData - 18 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 235k+ users between them. 4 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
World Time popup inserts server-supplied HTML and opens its links in new tabs
Code analysis shows the popup fetches three pages from linangdata.com and inserts them as HTML.
Links in that markup open as new tabs at addresses the server chooses.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You click the World Time toolbar icon to open the popup.
The popup requests three pages from linangdata.com and writes whatever HTML comes back into the popup.
Links in that HTML open in new tabs at the address the server supplies.
Fetch, inject and tab-open handler in js/app.js
The source ships unminified, so the shipped and readable forms are the same code. No JSON parsing, sanitizer or URL allowlist sits between the response and the DOM or the tab call.
js/app.js// response body (string) -> $(...).html(body)// any element.navopentab -> chrome.tabs.create({ url: element.href })- Request source tagsource=worldClock
Identifies which extension is asking for content.
- Request timestampuuid=1759312845123
Millisecond clock value sent as a cache-busting uuid.
- Response body<a class="navopentab" href="https://example.com/offer">Offer</a>
Markup the server returns and the popup inserts as HTML.
- Link targethttps://example.com/offer
The href of a navopentab link, opened in a new tab on click.
- linangdata.com
Serves dynamiclinks.php, bannertop.php and bannerbottom.php whose output is inserted into the popup.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed World Time contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- linangdata.comwidely used
World Time sends data to linangdata.com. A widely used service: 28 other extensions we have analysed send data here.