Security Alert: Confirmed Malware
Adblock Dragon
ID: mcmdolplhpeopapnlpbjceoofpgmkahc
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- jeannineescudero9374View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Fierce and relentless adblock extension. Best in class protection from ads.
Adblock dragon - Fierce and relentless AdBlock extension. The best in class protection from ads 😎 Features: 🔥 Protects your privacy by blocking tracking systems 🔥 Blocks video ads, banners, and text ads 🔥 Speeds up page loading With this extension, your online time will be a lot more productive!
On startup, the extension downloads an external whitelist from a remote server and merges it into the local whitelist. Because the URL uses plain HTTP, a network attacker could tamper with this response, and the server can remotely disable blocking on arbitrary domains without shipping a new extension update.
async function mr() { var qL, QV; const hH = qn.browser.runtime.getURL("adguard/filters.json"), Hl = await fetch(hH), XF = undefined, VW = (await Hl.json()) .filters.filter((qL => !qL.tags.includes(45) && 10 !== qL.filterId)) .map((qL => qL.filterId)), mr = await qn.browser.storage.local.get(["whitelist", "totalBlocked"]); let gH = null !== (qL = mr.whitelist) && void 0 !== qL ? qL : [], hD = null !== (QV = mr.totalBlocked) && void 0 !== QV ? QV : 0; const tx = {}; try { const qL = await fetch( `http://base-filter.s3-website.us-east-2.amazonaws.com/whitelist/${chrome.runtime.id}/filter.txt`); if (qL.ok) { const QV = undefined, hH = (await qL.text()) .split("\n") .map((qL => qL.trim())) .filter((qL => qL.length > 0)); for (const qL of hH) gH.includes(qL) || gH.push(qL) } } catch (qL) {}The content script hooks frame accessors and uses `eval` to inject code into page and iframe execution contexts. This is a powerful code-injection pattern that runs on every matched site at `document_start`, increasing the impact of any logic flaw or abuse in the injected payload.
function mr(hH) { try { if (hH && !VW(hH)) { ol(hH), hH[qL] = Hl; const XF = `'${qL}', ${QV}, true`; hH.eval(`(${qn()})(${XF});`), delete hH[qL] } } catch (qL) {}}function gH(qL) { const QV = Object.getOwnPropertyDescriptor(qL.prototype, "contentWindow"), hH = Object.getOwnPropertyDescriptor(qL.prototype, "contentDocument"); if (!QV) return; const Hl = Function.prototype.call.bind(QV.get), qn = Function.prototype.call.bind(hH.get); QV.get = function() { const qL = Hl(this); return mr(qL), qL }, hH.get = function() { return mr(Hl(this)), qn(this) }, Object.defineProperty(qL.prototype, "contentWindow", QV), Object.defineProperty(qL.prototype, "contentDocument", hH)The extension generates and persists a unique client ID in `chrome.storage.local`, then sends it to Google Analytics. This creates a durable identifier for the extension installation and enables usage tracking without any visible consent flow in the reviewed code.
const Hl = qL("uuid");async function qn() { const qL = await new Promise((qL => { chrome.storage.local.get(["cid"], (QV => { qL(QV) })) })); let { cid: QV } = qL; return QV || (QV = (0, Hl.v4)(), chrome.storage.local.set({ cid: QV })), QV}async function XF(qL) { const QV = undefined, hH = { v: "1", tid: qL, cid: await qn(), t: "pageview", dp: "/background", dt: "background", dh: `chrome-extension://${chrome.runtime.id}` }, Hl = `https://www.google-analytics.com/collect?${new URLSearchParams(hH).toString()}`; await fetch(Hl, { method: "POST", body: "" })This handler records per-request context and explicitly parses both outbound `Cookie` headers and inbound `Set-Cookie` headers. For an extension with `<all_urls>` and `webRequest` access, this gives visibility into authentication/session cookies across arbitrary sites, which is a sensitive collection point even though direct exfiltration was not observed in this snippet.
return qL.prototype.onBeforeRequest = function(qL, QV) { this.requestContextStorage.set(qL.requestId, { rules: QV, cookies: [], url: qL.url, tabId: qL.tabId }) }, qL.prototype.onBeforeSendHeaders = function(qL) { if (qL.requestHeaders) { var QV = this.requestContextStorage.get(qL.requestId); if (QV) { var hH = dC(qL.requestHeaders, "Cookie"); if (hH && hH.value) { var Hl = Vo.parseCookies(hH.value, QV.url); 0 !== Hl.length && (QV.cookies = Hl) } } } }, qL.prototype.onHeadersReceived = function(qL) { return XF(this, void 0, void 0, (function() { var hH, Hl, qn, XF, VW, mr, gH, hD; return ol(this, (function(ol) { switch (ol.label) { case 0: if (!(hH = this.requestContextStorage.get(qL.requestId))) return [ 2 ]; if (qL.responseHeaders) { for (Hl = Vo.parseSetCookieHeaders(qL.responseHeaders, hH.url), qn = Hl.filter((function(qL) {By severity
Versions scanned
Showing 3 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.6.6 | 4 |
| 1.6.5 | 8 |
| 1.6.4 | 5 |
Files with findings
2 distinct paths — top paths by unique finding count:
- js/background.js14
- js/content.js3
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.