Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Ask Search for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Ask Search for Chrome

ID: okmdknhejjiichkcppoppdaknekjekoa

Could be malicious

Supported Languages

🇸🇦Arabic

🇧🇷Brazilian Portuguese

🇳🇱Dutch

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇵🇹Portuguese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

50.205.19.64359

Size

0.06 MB

Rating

4.3/5

Reviews

Users

200,000

Type

Extension

Updated

Feb 24, 2025

Publisher Contextual Analysis

Trusted

Author: https://ext.ask.comView Profile
Privacy: Privacy Policy
Help: Help Center
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 555 W 18th St New York, NY 10011-2822 US
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,545

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Ask Search for Chrome offers convenient browsing tools.

Ask Applications® Search images, news, videos, maps, recipes and more with easy, safe, reliable search from Ask.com Answers you want. Content for days. What more could you Ask for? All that and more in a new Chrome window! By clicking the "Add To Chrome" and installing the Ask Search for Chrome extension, you agree to the End User License Agreement (https://eula.askapplications.com/eula/), the Privacy Policy (https://eula.askapplications.com/privacypolicy/) and to any additional terms set forth below. You further agree to receive any future updates and upgrades. For instructions on how to remove our extension, please visit https://support.askapplications.com/hc/en-us/articles/360024501074 For other support or to provide feedback, please visit us at https://support.askapplications.com/ Permissions Requested: "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display Notifications" This allows us the option to send you updates or additional product offers once you've already enjoyed the free product.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 46 ratings

Average Rating

Current: 4.22 / 5.0+0.03

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High8

Medium1

Low0

Versions scanned

Showing 1 of 7 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
50.197.19.63660 Code review	11

Extension Version	Code Review Findings
50.197.19.63660	11

Files with findings

9 distinct paths — top paths by unique finding count:

js/ask/apps/browser/cr/dlpCr.js2
js/ask/apps/extensionType/ds/cr/backgroundCrDS.js2
js/ask/apps/browser/cr/backgroundCr.js1
js/ask/apps/contentScript/extensionDetect.js1
js/ask/apps/contentScript/localStorageContentScript.js1
js/ask/apps/features/searchDefense.js1
js/ask/apps/pTagService.js1
js/ask/apps/remoteConfigLoader.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/ask/apps/features/searchDefense.js (line 134)	The SearchDefense module registers a blocking `onHeadersReceived` listener on `<all_urls>`, meaning every HTTP response across all tabs can be intercepted and arbitrarily redirected before it reaches the browser. The …	50.197.19.63660
2	Unauthorized Data Collection	critical	js/ask/apps/browser/cr/dlpCr.js (line 39)	The background page silently injects a hidden iframe pointing to `https://ext.dl.tb.ask.com/blank.jhtml`, which triggers the injection of `LocalStorageContentScript`. That content script then reads the entire localSto…	50.197.19.63660
3	Code Injection	high	js/ask/apps/browser/cr/backgroundCr.js (line 76)	The extension builds a JavaScript code string by direct string concatenation of `localStorageFieldName` and `value` parameters and executes it via `chrome.tabs.executeScript` with the `code` property. If either parame…	50.197.19.63660
4	Remote Code Loading	high	js/ask/apps/extensionType/ds/cr/backgroundCrDS.js (line 120)js/ask/apps/extensionType/ds/cr/backgroundCrDS.js (line 120)	On installation the extension silently loads a remote page from `hp.myway.com` (a MyWay/Mindspark property distinct from ask.com) in a hidden iframe injected into the background service worker document — this page is …	50.197.19.63660
5	Remote Code Loading	high	js/ask/apps/remoteConfigLoader.js (line 25)	The extension fetches a server-side configuration JSON from `https://ext.ask.com/images/download/static/native/dsserverconfig/dsserverconfig.json` on startup and schedules periodic refreshes via Chrome alarms. The fet…	50.197.19.63660
6	Tracking	high	js/ask/apps/unifiedLogging.js (line 56)	Every event fired (search actions, config loads, web request interceptions, permission changes, popUp displays, survey clicks) transmits a standard payload to `https://anx.tb.ask.com/anx.gif` containing: toolbarId, pa…	50.197.19.63660
7	Tracking	high	js/ask/apps/extensionType/ds/cr/backgroundCrDS.js (line 73)js/ask/apps/extensionType/ds/cr/backgroundCrDS.js (line 73)	The extension listens to every tab navigation event via `chrome.tabs.onUpdated` and dynamically injects multiple content scripts into any tab whose URL matches the `.ask.com` pattern. The match pattern is built at run…	50.197.19.63660
8	Tracking	high	js/ask/apps/pTagService.js (line 37)	The PTagService periodically phones home to `https://params.tb.ask.com/ptag` with user identity data (cobrand, vendorId, installDate, track) and receives `searchParams` objects that are appended to every search query …	50.197.19.63660
9	Unauthorized Data Collection	high	js/ask/apps/contentScript/localStorageContentScript.js (line 22)js/ask/apps/contentScript/localStorageContentScript.js (line 22)	This content script, injected into `ext.dl.tb.ask.com`, reads all keys from `window.localStorage` and returns them to the background page via a connected port. When no specific keys are requested it dumps the entire l…	50.197.19.63660
10	Unauthorized Data Collection	high	js/ask/apps/browser/cr/dlpCr.js (line 25)	The extension uses `chrome.cookies.getAll({ domain: domain })` on the `.ask.com` domain to collect all cookies on startup. The `parseCookies` function reduces the full cookies array into a data object and logs the ent…	50.197.19.63660
11	Tracking	medium	js/ask/apps/contentScript/extensionDetect.js (line 49)js/ask/apps/contentScript/extensionDetect.js (line 49)	When injected into `.ask.com` pages, this content script sets two tracking cookies (`mindsparktb_` and `mindsparktbsupport_`) directly on the page via `document.cookie`, identifying the extension installation to the…	50.197.19.63660

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ak.imgfarm.com	/images/vicinio/232530392/16x16_1471446408681.ico	http://ak.imgfarm.com/images/vicinio/232530392/16x16_1471446408681.ico
search.tb.ask.com	/search/GGmain.jhtml	https://search.tb.ask.com/search/GGmain.jhtml?searchfor={searchTerms}&enableSearch=true&rdrct=no&redirect=CPC
ss.search.ask.com	/ss	https://ss.search.ask.com/ss?li=ff&sstype=prefix&limit=10&hl=en&q={searchTerms}&enableSearch=true&rdrct=no
ext.dl.tb.ask.com	/blank.jhtml	https://ext.dl.tb.ask.com/blank.jhtml
hp.tb.ask.com	/tbask/index.html	https://hp.tb.ask.com/tbask/index.html?st=rc&tpr=omni&p2=\u003C!--partnerID--
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
ext.dl.tb.ask.com	/install_pixels.jhtml	https://ext.dl.tb.ask.com/install_pixels.jhtml?partner=${partnerID}
www.google-analytics.com	/debug/collect	https://www.google-analytics.com/debug/collect
hp.tb.ask.com	/tbask/index.html	https://hp.tb.ask.com/tbask/index.html?st=lc&tpr=omni&p2=
ext.dl.myway.com	/uninstall.jhtml	http://ext.dl.myway.com/uninstall.jhtml?c=

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Explore new opportunities with us to increase revenue and expand your chrome extension. See how we can help you. Details at: https://extensionbuysell.com We are looking forward to working with you! Best regards,

Madison Francis·20 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·8 Jun 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Ask Search for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 7 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating