Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
2 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
3D Soccer Slot Machine is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by remote code loading. It comes from a trusted publisher and was last updated in April 2026.
Key findings
- High
Remote Code Loading
The game polls a remote endpoint every 20 seconds (setInterval at:5119) and injects the server's raw `[domain withheld]` string as live DOM into the extension's own chrome-extension:// page, unsanitised, with a server-supplied auto-removal timer. This gives the operator an on-demand channel to render arbitrary markup — iframes, forms, full-page overlays, credential prompts — inside a browser-trusted extension origin at any moment after review; the manifest's `script-src 'self'` blocks inline <script> and event-handler attributes, but no is set for extension_pages, so framed remote content and overlay phishing remain available. Only the `occurrence` field is consumed by game logic (:3715), and `play_token` is assigned and never used, so the markup channel is not incidental to gameplay.
- High
Other
The bundled manifest declares `permissions: []` and `host_permissions: []`, while the live Chrome Web Store listing for this same extension declares `permissions: ["identity"]` and host_permissions for `[domain withheld], `[domain withheld], `[domain withheld] and `[domain withheld]. `identity` plus [domain withheld] lets the shipped build mint Google OAuth tokens for the signed-in user, a capability a 3D slot-machine game has no stated use for and which is entirely absent from the code in this archive — the signature of a staged capability added after the audited build. Separately, `externally_connectable` is opened to `<all_urls>`, so any web page may message the service worker, although in this bundle registers no handler.
Analyst notes
5117-5156 installs a 20-second polling channel to [domain withheld] whose JSON response field `[domain withheld]` is written straight into `tempDiv.innerHTML` and appended to `document.body` of the extension's own privileged chrome-extension:// tab, with an operator-supplied `info_timer` to silently remove it again — a server-controlled delivery channel that no slot-machine game needs, alongside an unused `play_token` and a dead ad-SDK top-frame URL harvester (`PAGE_URL`,:5092-5108); additionally pings cloudapi.stream on The bundled manifest declares zero permissions and zero host_permissions while the live CWS listing declares `identity` plus `[domain withheld], `wheel.`/`mines.cloudapi.stream` and `top.rodeo` — the ZIP I have is older than what users run, so the Google-OAuth capability is not auditable here, which is why I stop at likely_malicious rather than malicious. Corroborating context (not evidence): cloudapi.stream is the named C2 of the [domain withheld] 108-extension campaign in this extension's IoC notes, and the publisher is malicious leave-one-out; contradicting signals are our own risk engine (0.00, because the bundle declares no permissions) and chrome-stats (), both of which only read the manifest and never see the poller. Note the bundle is incomplete: 19 of 33 declared code files are absent per, including, createjs-2015.11.26. and howler. which loads before, so `user_id` (read at:5134, never written in the files provided) and any additional logic in them could not be reviewed.
3D Soccer Slot Machine Chrome extension security report
ID: kknakidneabpfgepadgpkibalcnabnnh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://top.rodeo/
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- DE
- Address
- Ringelsweide 28 Düsseldorf 40223 DE
- Website
- Visit
Screenshots & videos
Install growth
This extension requests no permissions and has no recorded risk factors.
- 2 high
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
2 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
3D Soccer Slot Machine: Chrome extension game
Read the publisher’s full description
3D Soccer Slot Machine is a Premium HTML5 Casino game. Are you ready for a new slot experience? Enjoy this 3D slot machine with the following features: - Bonus game with Penalty Kicks - Freespins - Auto-Spin - Exciting 3D Animations ATTENTION! This game is not for real money.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
2 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from https://top.rodeo/
- BlackJack 3D3,000 users
- Billiards Pro1,000 users
- 3D Roulette Casino Game1,000 users
- Slot Machine The Fruits886 users
- Flicking Soccer400 users
Popular in Games
- Boxel Rebound1,000,000 users
- Eneba - Seamless Keys Activation and Cheap Games Offers700,000 users
- Stacker - Falling tetra blocks!700,000 users
- Ultimate Car Driving Game500,000 users
- Boxel 3D500,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.