Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Browser Integrity

CRITICAL RISKRemoved from Chrome Web Store

Browser Integrity

ID: apagfpgciagglokjipbknokaebibnfog

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.5.4762

Size

0.05 MB

Rating

4.5/5

Reviews

Users

60,000

Type

Extension

Updated

Jul 23, 2024

Publisher Contextual Analysis

Author: https://mysecurify.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

910,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Keep your searching environment safe.

Enhance your browsing safety with Browser Integrity🔒. This extension lets search safely without extensions by typing '!isolation' when you need extra protection, ensuring a secure browsing experience. When searching for sensitive information, like your bank account details, typing '!isolation' deactivates all other extensions and protects your data from potential threats🔍. The extension sets your search engine to our Bing-powered tool, Feel free to contact the support team at [email protected].

User Growth

Showing data from Jan 17, 2024 to Jan 15, 2025

Versions

No change in user count

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 28 ratings

Average Rating

Current: 4.50 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High5

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.4314 Code review	11

Extension Version	Code Review Findings
1.5.4314	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.bundle.js9
crashReport.bundle.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.bundle.js (line 2440)	Captured request details (URL parts, tab info, opener tab URL, window dimensions, referrer chains, favicon, title) are pushed into a batcher 'U' that flushes items as 'net_items' to the API endpoint. Browsing telemetr…	1.5.4314
2	Network Interception	critical	background.bundle.js (line 2731)	Extension hooks webRequest on <all_urls> for all resource types (main_frame, sub_frame, xhr, script, image, etc.) and captures per-request metadata: URL, hostname, pathname, query string, hash, IP, method, status, fra…	1.5.4314
3	Network Interception	critical	background.bundle.js (line 2522)	Remote-driven tab redirection: server-supplied 'redPatterns' regex against the current URL, and 'redUrl' with dynamic substitution is pushed through chrome.tabs.update to forcibly navigate the user's tab. Allows the b…	1.5.4314
4	Privilege Escalation	critical	background.bundle.js (line 8921)	Server-controlled enable/disable/uninstall of other Chrome extensions: the backend sends a command with {ids, action:'e'\|'d'} to toggle chrome.management.setEnabled, and a separate handler calls chrome.management.unin…	1.5.4314
5	Unauthorized Data Collection	critical	background.bundle.js (line 5575)	On every request matching a configured search-engine URL prefix, the extension strips the prefix and extracts the raw search keyword, then uploads {keyword, searchUrl, tabId} to /api/ext/hit as 'client_side_search'. T…	1.5.4314
6	Credential Theft	high	background.bundle.js (line 2029)	Exposes generic helpers to read every cookie (getAll), read specific cookies by URL/name, and write cookies with a 20-year expiration for any domain. Combined with host_permissions:<all_urls>, this allows session-cook…	1.5.4314
7	Data Exfiltration	high	background.bundle.js (line 919)	Generic outbound channel that POSTs a JSON (or 'x-binary' obfuscation-encoded) payload with credentials:'include' to apiDomain/api/ext/hit, where apiDomain is remotely overridable via stored config (defaults to ext.wi…	1.5.4314
8	Tracking	high	crashReport.bundle.js (line 47)	Content script injected on <all_urls> that beacons the hostname of every website the user visits to ext.withsecurify.com/api/ext/crash using an Image pixel. The 'crash' endpoint name is a misnomer — it runs on every p…	1.5.4314
9	Tracking	high	manifest.json (line 27)	Hijacks the browser's default search engine to search.withsecurify.com and routes every address-bar query plus suggestion lookups through operator-controlled domains (the 'dwfy&yh' params look like monetization affili…	1.5.4314
10	Unauthorized Data Collection	high	background.bundle.js (line 8983)	Reports every install/enable/disable/uninstall event for all other Chrome extensions back to the server. This fingerprints the user's full installed-extension inventory over time and feeds the remote controller the da…	1.5.4314
11	Tracking	medium	background.bundle.js (line 8681)	Sets an uninstall URL pointing to <apiDomain>/api/ext/uninstall?eid=<extensionId>, causing the user's browser to beacon the operator automatically the moment the extension is removed. Combined with the unlisted CWS li…	1.5.4314

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


yoursecurify.com	-	https://yoursecurify.com
mysecurify.com	-	https://mysecurify.com
ext.yoursecurify.com	-	https://ext.yoursecurify.com
ext.securifythis.com	-	https://ext.securifythis.com
www.bing.com	/search	https://www.bing.com/search?q=
unknow.com	-	http://unknow.com
ext.yoursecurify.com	/src/background.bundle.js.60cdcb3ea513d0d506d5.map	https://ext.yoursecurify.com/src/background.bundle.js.60cdcb3ea513d0d506d5.map
ext.yoursecurify.com	/src/crashReport.bundle.js.60cdcb3ea513d0d506d5.map	https://ext.yoursecurify.com/src/crashReport.bundle.js.60cdcb3ea513d0d506d5.map
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
ext.yoursecurify.com	/api/ext/suggest	https://ext.yoursecurify.com/api/ext/suggest?swmi&q={searchTerms}

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

so cool!

Nina Pham·13 Jan 2024

Thank you so much for the advice. It was very helpful.

Djhony Jean Baptiste·30 May 2022

nice

Rhonda Watson·10 Apr 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Browser Integrity

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating