Bitwarden Password Manager
nngceckbapebfimnlniiiahkandclblb
Risk Score
3.27
Risk Level:
Low
Recommendation:
🟢 LOW RISK — review
Top Risks
- Privacy policy fetched but scope_extension=false and admits 3rd-party sharing — policy scores at Privacy pillar 10.0.
- webRequest + broad host permissions (*://*/*) give full HTTP request visibility across all sites.
- 5 innerHTML DOM-XSS sinks in content scripts; CSP present mitigates but script injection via page content remains a concern.
- Developer name field empty; no verified-publisher badge reduces reputation confidence.
- clipboardRead/Write + scripting on all sites: if extension were compromised, credential exfil surface is very large.
Evidence
- broad_host_permissions manifest host_permissions includes https://*/* and http://*/* — all sites.
- webRequest_high_perm manifest webRequest declared; observes all HTTP traffic across all origins.
- privacy_policy_scope_mismatch api Privacy policy fetched (32k chars) but scope_extension=false, data_collection=true, third_party_sharing=true.
- featured_by_google store is_featured_by_google=true; follows recommended practices badge present.
- no_verified_publisher store verified_publisher=false; developer_name empty; email hello@bitwarden.com on bitwarden.com domain.
- dom_xss_sinks crx 5 innerHTML sinks in autofill content scripts; CSP present (MV3 strict default) reduces exploitability.
- no_cve_findings crx cve_findings_raw empty; no known-bad hosts; no obfuscation (score=0.0).
- recently_updated store months_since_update=0; last updated June 3 2026; maintenance risk minimal.
CVE Exposures (21)
| CVE | Library | Severity | Fixed in | Summary |
|---|---|---|---|---|
| CVE-2022-48285 | jszip@unknown | moderate | 3.8.0 | JSZip contains Path Traversal via loadAsync |
| CVE-2021-23413 | jszip@unknown | moderate | 3.7.0 | jszip Vulnerable to Prototype Pollution |
| CVE-2026-33896 | node-forge@unknown | high | 1.4.0 | Forge has a basicConstraints bypass in its certificate chain verification (RFC 5 |
| CVE-2022-24773 | node-forge@unknown | moderate | 1.3.0 | Improper Verification of Cryptographic Signature in `node-forge` |
| CVE-2025-66031 | node-forge@unknown | high | 1.3.2 | node-forge has ASN.1 Unbounded Recursion |
| CVE-2025-12816 | node-forge@unknown | high | 1.3.2 | node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator |
| CVE-2026-33891 | node-forge@unknown | high | 1.4.0 | Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Ze |
| node-forge@unknown | node-forge@unknown | low | 1.0.0 | Prototype Pollution in node-forge debug API. |
| CVE-2025-66030 | node-forge@unknown | moderate | 1.3.2 | node-forge is vulnerable to ASN.1 OID Integer Truncation |
| CVE-2022-0122 | node-forge@unknown | moderate | 1.0.0 | Open Redirect in node-forge |
| CVE-2020-7720 | node-forge@unknown | high | 0.10.0 | Prototype Pollution in node-forge |
| CVE-2022-24771 | node-forge@unknown | high | 1.3.0 | Improper Verification of Cryptographic Signature in node-forge |
| CVE-2026-33894 | node-forge@unknown | high | 1.4.0 | Forge has signature forgery in RSA-PKCS due to ASN.1 extra field |
| CVE-2026-33895 | node-forge@unknown | high | 1.4.0 | Forge has signature forgery in Ed25519 due to missing S > L check |
| CVE-2022-24772 | node-forge@unknown | high | 1.3.0 | Improper Verification of Cryptographic Signature in node-forge |
| CVE-2020-36649 | papaparse@unknown | high | 5.2.0 | Regular Expression Denial of Service in papaparse |
| CVE-2025-15284 | qs@unknown | moderate | 6.14.1 | qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion |
| CVE-2014-10064 | qs@unknown | high | 1.0.0 | Denial-of-Service Extended Event Loop Blocking in qs |
| CVE-2017-1000048 | qs@unknown | high | 6.0.4 | Prototype Pollution Protection Bypass in qs |
| CVE-2022-24999 | qs@unknown | high | 6.10.3 | qs vulnerable to Prototype Pollution |
| CVE-2014-7191 | qs@unknown | high | 1.0.0 | Denial-of-Service Memory Exhaustion in qs |
Permissions Breakdown
- activeTab low Accesses current tab on user action only.
- alarms low Scheduling only, no data access.
- clipboardRead medium Can read clipboard content; needed for password copy workflows.
- clipboardWrite medium Can write to clipboard; core for password fill.
- contextMenus low Adds right-click menu entries; standard UI.
- idle low Detects idle state for vault auto-lock.
- offscreen low Off-screen document for background crypto ops.
- scripting medium Injects scripts into pages; required for autofill but elevated risk.
- sidePanel low UI panel, no privileged data access.
- storage low Local encrypted vault storage.
- tabs medium Reads tab URLs to match credentials; standard for password managers.
- unlimitedStorage low Large vault support.
- webNavigation medium Monitors page navigation for autofill triggers.
- webRequest high Can observe all HTTP requests; justified for password manager but high capability.
- webRequestAuthProvider medium Provides HTTP auth credentials; core password manager function.
- notifications low User alerts only.
- https://*/* high Broad host access across all HTTPS sites; required for autofill.
- http://*/* high Broad host access across all HTTP sites; required for autofill.
Pillar Scores
Permissions4.50
Reputation3.00
Network2.00
Webstore2.00
Maintenance0.00
Privacy10.00
Code Quality2.00
CVE Exposure0.00
Bookkeeping
Rubric v3.6
Scored at 2026-06-16 07:59
Listing SHA
b9f296645c69…
Force block
— not fired
Score recovered
no
Elapsed
30.9s