Is Cryptocurrency Price safe?
We analyzed Cryptocurrency Price version 1.2's actual code and gave it a 78/100 trust score. This is a narrowly scoped price-display extension with a…
Bottom line
This is a narrowly scoped price-display extension with a moderate popup-injection weakness but no established abuse.
What it can access
It requests only storage access and uses a price service for its feature, without webpage or private-data access [Q1][Q2][Q4].
Security weaknesses
Remote price data is inserted into the popup without adequate sanitization, creating a risk that a compromised service could alter the popup or deceive users [Q7][Q20].
Signs of misuse
The outside request is limited to cryptocurrency prices, with no evidence of tracking, credential collection, mining, or other harmful behavior [Q6][Q14][Q23].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only extension storage. No host, tab, history, cookie, bookmark, download or page-injection permission is declared.
Declares storage as its sole permission and a popup/service worker with no content scripts or host permissions. — manifest.json:4-21
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts or scripting permission. — manifest.json:4-21
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The popup-only extension has no webpage access. — manifest.json:4-21
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests storage only. — manifest.json:9-11
The tab-update callback only console.logs changeInfo and performs no data transfer. — background.js:1-10
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant permissions. — manifest.json:9-11
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the configured public coin-symbol list and selected conversion currency to tunghuynh.net. This is necessary for the advertised price lookup and contains no page data or identifier.
Builds a fixed-origin price request with symbol and convert query parameters. — popup/popup.js:131-135
Does it download or run code, settings, or instructions supplied by a remote server?
The price service supplies coin names, symbols, IDs and values that directly populate the popup. Several string fields are inserted as HTML without sanitization.
Parses remote JSON and concatenates item.id, item.symbol and item.name into innerHTML and image markup. — popup/popup.js:131-169
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Binds currency buttons and performs the initial lookup during popup DOMContentLoaded. — popup/popup.js:1-19,64-71
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests only storage. — manifest.json:9-11
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Bundled jQuery and Bootstrap libraries are minified, but the extension's own price and storage logic is short and readable. No obfuscated data was found.
Loads local minified framework files and the readable popup.js application script. — popup/index.html:1-7
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Bundled library defines globalEval as a generic capability. — popup/jquery.min.js:2
Remote response handling contains no eval, Function or string timer call. — popup/popup.js:131-181
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Network URLs are constructed from fixed hosts, a coin ID, the symbol list and conversion currency. — popup/popup.js:124-169
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Network code performs only price lookup and image loading. — popup/popup.js:1-181
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or identity permission; storage holds only the coin list. — manifest.json:9-11
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The extension does not execute in webpages. — manifest.json:4-21
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Places unsanitized remote strings into symbol.innerHTML and related HTML templates. — popup/popup.js:145-169
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no page content script. — manifest.json:4-21
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It fetches price JSON from tunghuynh.net and images from fixed CoinMarketCap hosts. No arbitrary proxy, download services or user-controlled destination was found.
Uses fixed remote origins; variable values affect query parameters and CoinMarketCap path segments only. — popup/popup.js:124-169
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no native or system-level permission. — manifest.json:9-11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote JSON reaches innerHTML but no script-evaluation sink; the MV3 default CSP restricts scripts to packaged files. — popup/popup.js:131-169
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable sites, content scripts or web-accessible bridge resources. — manifest.json:4-21
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads/writes crypto_list in storage.sync and uses it as the price-query symbol parameter. — popup/popup.js:64-87,131-134
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Fetches and renders prices without computational mining logic. — popup/popup.js:131-181
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The popup textarea is a local coin-list setting, not a webpage form. — popup/index.html:26-39