Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
2 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
American Roulette Royale, used by 1,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by remote code loading. It comes from a publisher with 32 extensions and was last updated in April 2026.
Key findings
- High
Remote Code Loading
Every 25 seconds (setInterval at:6132) the extension fetches an arbitrary HTML fragment from mines.cloudapi.stream and injects it into its own page via, with a server-supplied auto-removal timer. The extension_pages CSP is `script-src 'self'`, so an injected <script> will not execute, but the operator can still push iframes, credential-collecting forms, overlays and off-site links into a page the user trusts as part of an installed extension, and can change that payload at any time without a Web Store review. cloudapi.stream is the C2 domain listed in this extension's IoC notes for the Socket 108-extension campaign, and the unused `play_token` returned by the same response shows the channel is provisioned for capabilities beyond the game.
- High
Other
The bundled manifest declares no permissions and no host_permissions, while the live CWS listing for this extension declares `identity` plus host access to [domain withheld], wheel.cloudapi.stream, mines.cloudapi.stream and top.rodeo. That delta is precisely a Google OAuth token capability paired with two operator domains, and no code in this bundle uses chrome.identity, so the published build has reach the reviewed code does not account for. Compounding it, `externally_connectable` is opened to <all_urls> in both manifests while no onMessageExternal or onConnectExternal listener exists anywhere in the bundle, leaving any web page able to address the extension once a future version adds a handler.
Analyst notes
The bundled game is a re-skinned CodeThisLab roulette title (:1757 still contains the neutered `seekAndDestroy()` domain lock), but a hand-written block appended at:6128-6168 polls [domain withheld] every 25 seconds and writes the server's `[domain withheld]` string into the page via `innerHTML` + `appendChild`, giving the operator a persistent remote markup channel plus a `play_token` that no code in this version consumes. cloudapi.stream is the exact C2 domain recorded in this repo's IoC notes for the Socket 108-extension data-exfiltration / session-theft campaign, and pings it on install and uninstall with the extension ID; the live CWS manifest also adds `identity` and [domain withheld] which the bundled does not declare ( are both empty), so the shipped build carries Google OAuth capability that is absent from the code reviewed here. Corroborating: publisher GameGen is malicious leave-one-out, two IoC notes name this domain, and the ML `js_post_requests=1` hit is the real occurrence.php POST; contradicting: our risk engine scored 0.00 purely because the bundled manifest declares no permissions, and the high `js_innerhtml`/`js_exclamation` counts are mostly minifier `!0`/`!1` and Bootstrap DOM templating rather than malice. Verdict is capped at likely_malicious because no token-theft or page-content-harvesting code is quotable from this bundle; `localStorage.user_id` is read at:6146 but never written anywhere in the extension, so the identity plumbing is staged rather than active.
American Roulette Royale Chrome extension security report
ID: ejlcbfmhjbkgohopdkijfgggbikgbacb
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- GameGen
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
This extension requests no permissions and has no recorded risk factors.
- 2 high
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
2 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
American Roulette Royale: Chrome extension game
Read the publisher’s full description
"American Roulette Royale" is an exhilarating Chrome extension game that captures the essence of the iconic American casino experience. Step into the glamorous world of roulette and test your luck as you place bets on the spinning wheel. With stunning graphics and realistic gameplay, immerse yourself in the thrill of the casino floor without leaving your browser. Will you hit the jackpot and emerge as the ultimate roulette champion? Find out in "American Roulette Royale"! ATTENTION! This game is not for real money.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
2 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from GameGen
- Downloader For Instagram2,000 users
- Car Rush386 users
- Web Client for game BASEBALL PRO335 users
- Goalkeeper Challenge258 users
- Slot Machine Mr Chicken237 users
Popular in Games
- Boxel Rebound1,000,000 users
- Eneba - Seamless Keys Activation and Cheap Games Offers700,000 users
- Stacker - Falling tetra blocks!700,000 users
- Ultimate Car Driving Game500,000 users
- Boxel 3D500,000 users