Untrusted Types for DevTools

Abusing Trusted Types to discover XSS sinks.

Untrusted Types for DevTools: Discover XSS Sinks

'Untrusted Types for DevTools' is a Chrome extension designed to uncover potential DOM XSS vulnerabilities. By abusing Trusted Types, this extension identifies sinks, or code patterns, that could potentially execute dangerous JavaScript code if provided with malevolent inputs. The extension adds a dedicated panel to DevTools giving users the ability to view and filter sink logs, customize settings, and even highlight keywords passed in a sink. Furthermore, it aids in the exploration of stack traces of specific logs, helping developers ensure safer, more secure applications.

Download

Extension stats

By: Thomas Orlita

Users: 1,000+

Rating: 5.00

(3)

Version: 1.1.1 (Last updated: 2021-10-12)

Creation date: 2021-01-22

Permissions:

storage
webRequest
webRequestBlocking
http://*/*
https://*/*

Size: 40.10K

Email: in*****@thomasorlita.com

Full description: See detailed description

Ranking

# 28,520 ▲ 3

Other rankings

#970 in Developer Tools ▼ 5 #296 in console keyword 13 ▲ 4

Other platforms

Not available on Android

Not available on Firefox

Not available on Edge

User reviews

fantastic tool! helps me display the xss dom sink in devtools console! Thanks

Rizan Fauzi, 2021-08-31

View all user reviews

Extension safety

Risk impact

Untrusted Types for DevTools requires some sensitive permissions that could impact your browser and data security. Exercise caution before installing.

Risk impact analysis details

Critical Grants access to browser tabs, which can be used to track user browsing habits and history, presenting a privacy concern.
Critical ****** ****** ** *** ********* ****** * *********** ******** **** ** ** *** ******* *** ****** **** **** *** ******* *****
High ******* ******* **** *** ****** ***** *** ***** ** ******* **** ********* ********* ** * *********** *****
Medium ****** ** ********* ****** ********* *** **** ****** **** **** ** ******* ** ********** **** ***********
Low ******* ****** ** *** ********* ********

Risk likelihood

We don't have sufficient data to confidently determine the risk likelihood of Untrusted Types for DevTools. Use it at your own risk.

Risk likelihood analysis details

High This extension has low user count. Unpopular extensions may not be stable or safe.
Low **** ********* *** ******* **** **** * ****** **** ***** ******** *** **** ****** ** ** ****** *** *****
Low **** ********* *** ***** **** **** * ****** **** ***** ********** *** **** ****** ** ** ****** *** *****
Good **** ********* ********* ** * ******* ********* ** ****** *** *****
Good **** ********* *** **** **** *******