Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adclash adblocker

CRITICAL RISKRemoved from Chrome Web Store

Adclash adblocker

ID: kbcmbienjknhlkpnbbbodnalnichbmef

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.12

Size

0.26 MB

Rating

4.7/5

Reviews

Users

1,331,483

Type

Extension

Updated

Oct 31, 2020

Publisher Contextual Analysis

Author: Ernie RobertsView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

2,851,578

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Remove all ads and improve your browsing experience

Adkrig - adblocking software. It blocks all kinds of ads e.g. video ads, banners, context ads. Features: 🌟 Well-tuned preset of open-source blocking filters 🌟 Geo-based filter rules are applied automatically. You don’t have to set up the extension, it just works. 🌟 Manage ad blocking on the domain level. You can enable\disable ad-blocking at any time. Please share your feedback in the Reviews section of the Chrome Webstore.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High4

Medium3

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.12 Code review	4
2.11 Code review	7

Extension Version	Code Review Findings
2.12	4
2.11	7

Files with findings

4 distinct paths — top paths by unique finding count:

bg.js8
content.js1
popup.html1
subscriptions.xml1

S.No.	Category	Severity	File	Summary	Found in Version
1	Phishing	critical	bg.js (line 6)	The notification system downloads a JSON payload from `cdn.easyadblocker.com/notification.json` hourly and, upon user interaction (or automatically for `critical`/`relentless` notification types), calls `browser.tabs.…	2.11
2	Remote Code Loading	critical	bg.js (line 233)	This code obfuscates and injects a Google Tag Manager loader by building a remote URL from the manifest CSP and appending a DOM element dynamically. In a privileged extension background page, this creates a remote cod…	2.12
3	Remote Code Loading	critical	subscriptions.xml (line 1)	All 24 filter list subscriptions — including EasyList, EasyPrivacy, and every regional variant — are routed through the third-party domain `rules.easyadblocker.com` instead of their legitimate origins (easylist.to, et…	2.11
4	Unauthorized Data Collection	critical	bg.js (line 6)	The extension's Acceptable Ads exception list (`exceptionrules.txt`) and the anti-adblock filter list are served exclusively from `rules.easyadblocker.com`, a third-party domain not affiliated with Eyeo GmbH (the real…	2.11
5	Code Injection	high	content.js (line 1108)	The content script injects serialized code into the page context with `contentWindow.eval(...)` and monkey-patches frame accessors so the injection reaches iframes and object elements. Running this on all HTTP(S) page…	2.12
6	Remote Code Loading	high	bg.js (line 6)	The notification module polls `cdn.easyadblocker.com/notification.json` starting 1 minute after install and then every hour indefinitely. The downloaded JSON is parsed and stored in extension storage as authoritative …	2.11
7	Tracking	high	bg.js (line 6)	The `setUninstallURL` function constructs a telemetry-laden URL containing the user's addon name, version, browser application, application version, OS platform, platform version, notification download frequency, and …	2.11
8	Unauthorized Data Collection	high	bg.js (line 6)	On first run, the extension silently subscribes every new user to the `Acceptable Ads` program sourced from `rules.easyadblocker.com/exceptionrules.txt`. This bypasses ad-blocking for the third-party operator's chosen…	2.11
9	Tracking	medium	bg.js (line 10154)	The extension periodically pulls server-controlled notification data from `https://cdn.easyadblocker.com/notification.json` and stores it directly in local preferences. Because the same notification subsystem later us…	2.12
10	Tracking	medium	popup.html (line 1)	The popup UI loads Font Awesome CSS directly from `cdnjs.cloudflare.com` — an external third-party CDN — rather than bundling it locally. Every time a user opens the extension popup, an HTTP request is made to Cloudfl…	2.11
11	Unauthorized Data Collection	medium	bg.js (line 9879)	After repeated download failures, the extension sends a background request containing the add-on version, the subscription URL, the failing download URL, and error/status metadata to `adblockplus.org`. This is a telem…	2.12

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rules.easyadblocker.com	/easylist.txt	https://rules.easyadblocker.com/easylist.txt
easylist.to	-	https://easylist.to/
rules.easyadblocker.com	/abpindo+easylist.txt	https://rules.easyadblocker.com/abpindo+easylist.txt
abpindo.blogspot.com	-	http://abpindo.blogspot.com/
rules.easyadblocker.com	/abpvn+easylist.txt	https://rules.easyadblocker.com/abpvn+easylist.txt
abpvn.com	-	http://abpvn.com/
rules.easyadblocker.com	/bulgarian_list+easylist.txt	https://rules.easyadblocker.com/bulgarian_list+easylist.txt
stanev.org	/abp/	http://stanev.org/abp/
rules.easyadblocker.com	/easylistchina+easylist.txt	https://rules.easyadblocker.com/easylistchina+easylist.txt
abpchina.org	/forum/	http://abpchina.org/forum/

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

it works :)

instagram vistekk·13 Dec 2020

Full working on left or right or bottom small picture or ads

hacker expert·15 Nov 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adclash adblocker

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating