Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adtrooper adblocker

CRITICAL RISKRemoved from Chrome Web Store

Adtrooper adblocker

ID: ahefcccpaeeajbnnginkpdampgmadffb

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.1.2

Size

0.50 MB

Rating

3.7/5

Reviews

Users

159,421

Type

Extension

Updated

Oct 1, 2020

Publisher Contextual Analysis

Author: June RogersView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

159,421

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Adtrooper fights ads and protects your browsing experience

Adtrooper is an adblocker software. We fight on your side, preventing ad companies from hurting your browsing experience. Features: ✰ Automatically set up ad blocking rules by your geography ✰ Doesn’t slow down web pages loading speed ✰ No such thing as “Acceptable Ads” ✰ Whitelist - if you want to support a specific website or it doesn’t work

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High6

Medium2

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.1.1 Code review	10

Extension Version	Code Review Findings
2.1.1	10

Files with findings

3 distinct paths — top paths by unique finding count:

lib/easyadblock.js5
include.preload.js3
popup.html2

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	lib/easyadblock.js (line 772)	The extension downloads its filter rules exclusively from `rules.easyadblocker.com` and periodically fetches a `notification.json` from `cdn.easyadblocker.com` — neither of which is a known legitimate filter list prov…	2.1.1
2	Code Injection	high	include.preload.js (line 1584)	The extension constructs a script element from a Blob URL containing the serialized `injected()` function and appends it directly to every web page's DOM at document_start on all http/https URLs. This injects extensio…	2.1.1
3	Code Injection	high	include.preload.js (line 1332)	The extension overrides the `contentWindow` and `contentDocument` property descriptors on HTMLFrameElement, HTMLIFrameElement, and HTMLObjectElement prototypes. Whenever any page script accesses an iframe's contentWin…	2.1.1
4	Code Injection	high	include.preload.js (line 1324)	This content script recursively injects code into frame contexts using `contentWindow.eval(...)`. Even if intended to wrap WebRTC behavior, cross-frame eval-based injection is a high-risk pattern because it executes e…	2.1.1
5	Data Exfiltration	high	lib/easyadblock.js (line 4320)	On filter-download failures, the extension sends a background XMLHttpRequest to a fallback URL that includes the subscription URL, the exact download URL attempted, the error message, and HTTP channel/response status …	2.1.1
6	Other	high	lib/easyadblock.js (line 1061)	The Chrome Web Store listing names the extension "Adtrooper adblocker" (ID: ahefcccpaeeajbnnginkpdampgmadffb), but internally the extension declares itself as `easyadblockchrome` version 0.9.5 and all filter/notificat…	2.1.1
7	Remote Code Loading	high	popup.html (line 7)	The extension popup pulls a stylesheet directly from a third-party CDN instead of packaging it locally. Remote resources let the extension UI change based on network-delivered content and create an unnecessary trust d…	2.1.1
8	Network Interception	medium	lib/easyadblock.js (line 106)	The extension defines a regex to detect and treat as invalid any CSP filter that includes `base-uri`, `referrer`, `report-to`, `report-uri`, or `upgrade-insecure-requests` directives. Since filter rules are downloaded…	2.1.1
9	Network Interception	medium	lib/easyadblock.js (line 5779)	The background script registers a blocking `webRequest.onBeforeRequest` handler across `<all_urls>` and inspects request metadata before optionally canceling requests. This is core ad-blocking behavior, but it also gi…	2.1.1
10	Remote Code Loading	low	popup.html (line 10)	The extension popup loads a CSS stylesheet from an external CDN (Cloudflare) at runtime rather than bundling it locally. While Font Awesome 4.7.0 on cdnjs is currently benign, loading remote resources from an extensio…	2.1.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

140

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.googletagmanager.com	/gtm.js	https://www.googletagmanager.com/gtm.js?id=GTM-WXZVPZ3&l=
bugs.chromium.org	/p/chromium/issues/detail	https://bugs.chromium.org/p/chromium/issues/detail?id=665843
chromium.googlesource.com	/chromium/src/+/02d3f50b/content/browser/frame_host/navigation_request.cc	https://chromium.googlesource.com/chromium/src/+/02d3f50b/content/browser/frame_host/navigation_request.cc#473
chromium.googlesource.com	/chromium/src/+/39a7d96/net/http/http_response_headers.cc	https://chromium.googlesource.com/chromium/src/+/39a7d96/net/http/http_response_headers.cc#929
chromium.googlesource.com	/chromium/src/+/02d3f50b/content/browser/loader/mime_sniffing_resource_handler.cc	https://chromium.googlesource.com/chromium/src/+/02d3f50b/content/browser/loader/mime_sniffing_resource_handler.cc#534
chromium.googlesource.com	/chromium/src/+/02d3f50b/net/http/http_content_disposition.cc	https://chromium.googlesource.com/chromium/src/+/02d3f50b/net/http/http_content_disposition.cc#374
chromium.googlesource.com	/chromium/src/+/16e2688e/net/http/http_util.cc	https://chromium.googlesource.com/chromium/src/+/16e2688e/net/http/http_util.cc#431
chromium.googlesource.com	/chromium/src/+/99f41af9/net/http/http_util.cc	https://chromium.googlesource.com/chromium/src/+/99f41af9/net/http/http_util.cc#66
chromium.googlesource.com	/chromium/src/+/3130418a/net/base/mime_sniffer.cc	https://chromium.googlesource.com/chromium/src/+/3130418a/net/base/mime_sniffer.cc#667
*	/*	http:///

Showing 1 to 10 of 140 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.3.14.3	IPv4	-
2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Gayet iyi çalışıyor

Anonymous·22 Sept 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adtrooper adblocker

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews