Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Car Rush is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by other. It comes from a publisher with 32 extensions and was last updated in April 2026.
Key findings
- High
Other
The bundled manifest for 2.7.6 declares no host_permissions at all, but the live Chrome Web Store listing for this extension declares [domain withheld], [domain withheld] and [domain withheld] — independently corroborated by chrome-stats' "access-to-specific-domain: [domain withheld], cloudapi.stream". The shipping build therefore has authenticated-origin reach into cloudapi.stream, the C2 domain recorded in our IoC notes for the Socket 108-extension exfiltration campaign, while the code reviewed here does not; 'wheel' and 'mines' subdomains have no plausible function in a single-player racing game. A permission delta of exactly this shape is how a delayed-malicious update presents: the audited ZIP is clean and the installed build is not.
- Medium
Other
The service worker is the only non-game code in the package and its sole purpose beyond opening the game tab is to contact cloudapi.stream on install, on every update, and on uninstall, carrying [domain withheld]. Taken with externally_connectable: <all_urls> (:18) declared with no onMessageExternal handler anywhere in the bundle, this build is a game shell wired for remote reach rather than one using it: an open message channel any web page can address, plus a per-install callback to the campaign C2 whose endpoint can serve arbitrary content into a tab the user did not open. Not logged as because cloudapi.stream hosts the publisher's own declared privacy policy and so is first-party by disclosure; it is logged because the destination is the IoC-listed C2 and the capability set is staged rather than used.
Analyst notes
The bundled 2.7.6 code is an unmodified CodeThisLab "Car Rush" HTML5 game ( +,, bootstrap bloat) with zero network calls, zero chrome.* privilege use beyond chrome.tabs.create on its own page, and no obfuscation — the ML regex hits are template noise (the single innerHTML in:766 is a media-query font probe, seekAndDestroy() at:6569 is the vendor's domain-lock stub neutered to return!0, and PAGE_URL at:6567 is computed but never read or transmitted). What stops this being a false positive is off-code and manifest-level: the bundled manifest declares host_permissions: [] (:29) while the live CWS listing declares [domain withheld], [domain withheld] and [domain withheld] — chrome-stats independently corroborates that live host access — so the shipping build has reach into the cloudapi.stream C2 named in our IoC notes (Socket 108-extension campaign) that this ZIP does not, the classic delayed-malicious-update shape. externally_connectable: <all_urls> (:18) is a dormant channel with no onMessageExternal listener in this build, and: pings cloudapi.stream with [domain withheld] on (first-party by disclosure, the privacy policy is hosted on cdn.cloudapi.stream, so not itself a data-exfiltration finding). Publisher reputation ( malicious, flagged) corroborates; our own risk-engine 0.00 and the low chrome-stats impact contradict, but both only read the permission-less bundled manifest. Coverage gap: loads, and, which confirms are in the package but were not included in the extract directory, so a backdoor planted inside a vendor library could not be ruled out.
Car Rush Chrome extension security report
ID: hlmdnedepbbihmbddepemmbkenbnoegd
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- GameGen
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
This extension requests no permissions and has no recorded risk factors.
- 1 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Car Rush: Chrome extension game
Read the publisher’s full description
Car Rush is a HTML5 Racing Game. Start the engine and drive through three words with three different tracks of increasing difficulty each. Avoid obstacles and complete all the laps before the time runs out!
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from GameGen
- Downloader For Instagram2,000 users
- American Roulette Royale1,000 users
- Web Client for game BASEBALL PRO335 users
- Goalkeeper Challenge258 users
- Slot Machine Mr Chicken237 users
Popular in Games
- Boxel Rebound1,000,000 users
- Eneba - Seamless Keys Activation and Cheap Games Offers700,000 users
- Stacker - Falling tetra blocks!700,000 users
- Ultimate Car Driving Game500,000 users
- Boxel 3D500,000 users