Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Among Us PC

CRITICAL RISKRemoved from Chrome Web Store

Among Us PC

ID: feahfocfkioghnkmlnnnljikbfmdgbac

Could be malicious

Extension Info & Metadata

Status

Removed

Version

90.10.289.102

Size

8.37 MB

Rating

5.0/5

Reviews

Users

156,596

Type

Extension

Updated

Jan 5, 2021

Publisher Contextual Analysis

Author: https://sites.google.com/view/among-us-gameView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

156,596

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Among Us PC extension provide you with Among Us game in new tab page. Created for Among Us PC fans.

Check out all the amazing features you’ll find on the Among Us PC extension: ★ Shuffle Among Us every time you open a new tab. ★ Select a slideshow of randomly selected Among Us PC or from your list of favorites. ★ On-screen sticky notes and to-do reminders for completing real-life tasks with Among Us feel. ★ Get easy access to your most frequently visited websites. ★ Quick Launch your favorites apps right on the default page. This game was released in June 2018 but didn’t gain its deserved attention until 2020. The game became one of the most popular games on multiple platforms because of its very simple gameplay suitable for both kids and adults. Gamers can play Among Us PC with other players around the globe by choosing a lobby created in certain languages. How do I uninstall Among Us PC extension? 1. Click on the button with three horizontal lines or the three dots found in the upper right-hand corner of your Chrome™ browser. 2. From the drop-down menu click More Tools > Extensions. 3. Next to the extension you want to remove, click Remove. 4. If you simply want to hide the extension but not remove it, you can un-check the Enabled button. 5. Restart Chrome™ browser By installing this extension, you agree to the End User License Agreement (https://sites.google.com/view/among-us-game/terms-of-use) and Privacy Policy (https://sites.google.com/view/among-us-game/privacy-policy)

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High9

Medium3

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
90.10.289.101 Code review	15

Extension Version	Code Review Findings
90.10.289.101	15

Files with findings

4 distinct paths — top paths by unique finding count:

html/chrome/background.js9
html/search/newtab-base.js3
html/chrome/fsshare.js2
html/common/default-whitelist.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	html/search/newtab-base.js (line 346)	The server-provided 'geodata' response includes 'nav' and 'quotes' fields whose raw HTML string values are parsed via jQuery's .html() and directly appended to the DOM on every new tab load. There is no sanitization o…	90.10.289.101
2	Phishing	critical	html/chrome/background.js (line 37)	When the remote C2 server sets the 'webtab' field in its geo response, the newtab_url is overwritten with a remotely-specified URL. Subsequently, every time the user opens a new tab, the existing tab is silently remov…	90.10.289.101
3	Unauthorized Data Collection	critical	html/chrome/background.js (line 21)	The background script constructs a tracking beacon URL with a persistent unique user ID (uid), installation date, days since install, user group assignment, extension version, and extension ID, and POST-sends it to a …	90.10.289.101
4	Code Injection	high	html/search/newtab-base.js (line 300)	This helper parses arbitrary HTML strings and turns them into live DOM nodes inside the extension page. In this codebase those strings come from server-controlled `geodata` content, so the backend can inject new links…	90.10.289.101
5	Code Injection	high	html/search/newtab-base.js (line 346)	A second, nearly identical path renders server-provided HTML from `user["geodata"]` into quote/intro sections. Reusing remote HTML in multiple places increases the risk that operators can push deceptive content or dyn…	90.10.289.101
6	Phishing	high	html/chrome/background.js (line 31)	The server response is allowed to overwrite `newtab_url` with an arbitrary remote URL. This gives the backend control over what page is shown in the browser's new-tab context, creating a remote content switch that can…	90.10.289.101
7	Privilege Escalation	high	html/chrome/background.js (line 612)	The extension accepts incoming cross-extension messages from any extension whose hashed ID appears in a pre-compiled whitelist of ~500 entries (default-whitelist.js), or from any other extension that has the same set …	90.10.289.101
8	Privilege Escalation	high	html/common/default-whitelist.js (line 1)	A hardcoded list of approximately 500 hashed extension IDs is bundled into the extension and used to grant unconditional trust for cross-extension messaging. These hashes (DJB2-variant) correspond to a large network o…	90.10.289.101
9	Remote Code Loading	high	html/chrome/background.js (line 772)	When a new tab opens, the extension closes its own tab and replaces it with whatever URL is stored in `newtab_url`. Because that value is populated from remote server data elsewhere in the file, the extension can sile…	90.10.289.101
10	Tracking	high	html/chrome/background.js (line 825)	Immediately upon installation, the extension hijacks the user's currently active tab and redirects it to an external URL on games.lol with the extension ID appended as a tracking parameter. This happens silently witho…	90.10.289.101
11	Tracking	high	html/chrome/background.js (line 94)	On first run, the extension generates a persistent pseudo-UUID stored as 'uid' and assigns the user to a numbered A/B test 'user_group' (1-10). These identifiers are never disclosed to the user and are transmitted on …	90.10.289.101
12	Unauthorized Data Collection	high	html/chrome/background.js (line 694)	The background page exposes a message handler that allows any content script (including those injected into the new tab page) to retrieve the user's top visited sites, enumerate all installed extensions, enable/disabl…	90.10.289.101
13	Other	medium	html/chrome/background.js (line 825)	On installation, the extension force-navigates the user's currently active tab to a remote landing page. Replacing the active tab like this is a common growth/monetization pattern and is suspicious because it hijacks …	90.10.289.101
14	Tracking	medium	html/chrome/fsshare.js (line 21)	The share module requests a backend token and then submits sharing metadata to a remote URL-shortening/generation API. This is not credential theft, but it is suspicious tracking infrastructure because the operator ca…	90.10.289.101
15	Tracking	medium	html/chrome/fsshare.js (line 63)	Opening the share dialog immediately logs an analytics event to the vendor backend. Combined with the rest of `fsshare.js`, this shows fine-grained behavioral tracking of user actions inside the extension UI.	90.10.289.101

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	/webstore/detail/	https://chrome.google.com/webstore/detail/
games.lol	/ext/rfdext	https://games.lol/ext/rfdext?extid=
www.facebook.com	/dialog/share	https://www.facebook.com/dialog/share?app_id=362300054804616&display=popup&hashtag=%23freeplay&quote=
twitter.com	/share	https://twitter.com/share?text=
wa.me	-	https://wa.me/?text=
www.pinterest.com	/pin/create/button/	https://www.pinterest.com/pin/create/button/?url=
www.linkedin.com	/shareArticle	https://www.linkedin.com/shareArticle?mini=true&url=
share.flipboard.com	/bookmarklet/popout	https://share.flipboard.com/bookmarklet/popout?v=2&url=
www.reddit.com	/submit	https://www.reddit.com/submit?url=
www.facebook.com	/dialog/send	http://www.facebook.com/dialog/send?app_id=362300054804616&link=

Showing 1 to 10 of 80 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


0.1.9.3	IPv4	-
0.1.9.5	IPv4	-
0.1.9.6	IPv4	-

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

another great extension of among us! This is really working fine from my end!

Dude Star·29 Jan 2021

Cool extensions!!lhd wallpapers are nice.

Delinda Estrella·28 Jan 2021

this is the game that sick me off, but this wallpapers is cooling me down 💖💖

Lise Slack·27 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Among Us PC

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions15

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews