Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Browser WatchDog for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Browser WatchDog for Chrome

ID: jjnfhbcilcppomkcmkbbmcadoihkkgah

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.0.5696.1

Size

0.68 MB

Rating

4.6/5

Reviews

121

Users

200,000

Type

Extension

Updated

Apr 29, 2025

Publisher Contextual Analysis

Trusted

Author: https://browserdog.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browser Watchdog offers an easy scan and cleanup of your browser exntensions.

Browser WatchDog scans and removes annoying, intrusive, and malicious extensions that creeped into your browser! Bad extensions - be gone! ☠️ Bad extensions can cause anything from an annoying browsing experience such as bombardment by ads to serious information leakages. Browser WatchDog works out of the box and immediately after installation scans all your installed extensions, analyzes their permissions, and compares them to known and unknown blacklists and bad actors. Once a compromised add-on or extension is found in your browser, Browser WatchDog lets you remove it with a single click. Scanning can be triggered manually by clicking the Browser WatchDog icon but is also done periodically, a few times a day. Browser WatchDog is completely FREE and no signup is required. * Browser WatchDog is an independent developer and is not affiliated with any major browser manufacturer. * For questions, issues or false positives, Email [email protected] For privacy, visit https://browserdog.com/privacy Happy browsing! 🐶

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 4 months ago

2 versions released in this period

Rating Count

Total: 126 ratings

Average Rating

Current: 4.56 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical8

High4

Medium0

Low0

Versions scanned

Showing 1 of 7 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.3824.1 Code review	12

Extension Version	Code Review Findings
1.0.3824.1	12

Files with findings

1 distinct path — top paths by unique finding count:

background.js12

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 4469)	The extension uses `chrome.scripting.executeScript` to inject arbitrary JavaScript functions into any tab. The injected `Ge()` function (line 4513) implements a full DOM manipulation engine capable of: creating HTML e…	1.0.3824.1
2	Data Exfiltration	critical	background.js (line 140)	The extension defines multiple hardcoded command-and-control endpoints (browserdog.com, browserdoghouse.com, ext.browserdog.com) along with a tracking cookie name `_wdwdwdwdwdwdwd_`, a numeric XOR key (241 / `k`), and…	1.0.3824.1
3	Data Exfiltration	critical	background.js (line 266)	All POST requests to the C2 servers use `credentials: "include"`, meaning the browser attaches session cookies for every domain targeted, enabling cross-site tracking and potential session token exfiltration. The requ…	1.0.3824.1
4	Network Interception	critical	background.js (line 7606)	The extension registers `onBeforeRequest`, `onBeforeSendHeaders`, `onCompleted`, `onBeforeRedirect`, `onResponseStarted`, and `onErrorOccurred` listeners across ALL URL patterns and ALL request types (main_frame, sub_…	1.0.3824.1
5	Phishing	critical	background.js (line 4750)	The injected content script (executed via `scripting.executeScript`) creates a hidden `<iframe>` pointing to a server-controlled URL and appends it to `document.body` of the visited page. The iframe src and style are …	1.0.3824.1
6	Privilege Escalation	critical	background.js (line 9609)	Function `Ii()` (handler for a server-side command) accepts an array of extension IDs from the C2 server and calls `chrome.management.uninstall()` on each one. Combined with the `chrome.management` permission, this al…	1.0.3824.1
7	Unauthorized Data Collection	critical	background.js (line 3291)	Function `B()` (aliased as `N()`) calls `chrome.cookies.getAll({name: "_wdwdwdwdwdwdwd_"})` to enumerate every domain where the tracking cookie `_wdwdwdwdwdwdwd_` exists, extracts a timestamp from each cookie value, a…	1.0.3824.1
8	Unauthorized Data Collection	critical	background.js (line 7574)	The function `Ya()` (called as `Fa()`) intercepts client-side searches and transmits the raw `keyword`, `searchUrl`, `tabId`, and full `requestDetails` object to the C2 server under the event name `client_side_search`…	1.0.3824.1
9	Obfuscation	high	background.js (line 307)	Functions `w()` and `g()` implement symmetric XOR obfuscation with the hardcoded key `d = 241` (k at line 159), applied byte-by-byte and base64-encoded before sending to the C2 server. This is used when the `isEnc` fl…	1.0.3824.1
10	Tracking	high	background.js (line 6629)	The extension registers listeners on all four `chrome.management` lifecycle events (enabled, disabled, uninstalled, installed) and reports the full extension `info` object for each event to the C2 server. This gives t…	1.0.3824.1
11	Tracking	high	background.js (line 8394)	The `Wo()` function assembles a comprehensive device/browser fingerprint on every request to the C2 server, including: browser language, local time, timezone offset, Chrome runtime ID, extension version, manifest vers…	1.0.3824.1
12	Unauthorized Data Collection	high	background.js (line 8444)	Function `Vo()` calls `chrome.topSites.get()` (via `$e()`) and attaches the user's most-visited sites list to the request payload unless the event type is in a server-controlled exclusion list (`noTsActions`). This ex…	1.0.3824.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
browserdog.com	-	https://browserdog.com
ext.browserdog.com	-	https://ext.browserdog.com
ext.browserdoghouse.com	-	https://ext.browserdoghouse.com
unknow.com	-	http://unknow.com
ext.browserdog.com	/src/bg.js.5a585e7881909607bc1b.map	https://ext.browserdog.com/src/bg.js.5a585e7881909607bc1b.map
ext.browserdog.com	/src/style.css.5a585e7881909607bc1b.map*/	https://ext.browserdog.com/src/style.css.5a585e7881909607bc1b.map*/
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

We are looking for a partnership to explore new sources of income for chrome extensions. We believe that this partnership can help your business grow stronger. See more at: https://extensionbuysell.com Looking forward to working with you! Best regards,

Madison Francis·20 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·8 Jun 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Browser WatchDog for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 7 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating