Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Choix messagerie

CRITICAL RISKRemoved from Chrome Web Store

Choix messagerie

ID: fgmpobnmaddonjdecjcmhlpabgmmfjhi

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0

Size

0.02 MB

Rating

0.0/5

Reviews

Users

135,419

Type

Extension

Updated

Jul 13, 2020

Publisher Contextual Analysis

Author: choix-messagerie.comView Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

135,419

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Sélectionnez votre messagerie préférée

Utilisez notre plugin pour envoyer directement vos mails sans avoir à choisir à chaque envoi le service mail que vous souhaitez utiliser. Une fois votre service de messagerie favori défini, vous n’aurez plus qu’un clic à faire pour qu’un nouvel onglet s’ouvre automatiquement avec votre boîte mail préférée. Envoyez autant de mails que vous le souhaitez et surtout gagnez du temps ! Une fois installée sur votre navigateur, l’extension « Choix messagerie » vous permet, depuis les pages contact des sites, d’envoyer un mail via votre messagerie préférée. Un simple clic sur un bouton « Contact » ou sur l’icône « Mail » suffit pour arriver directement sur votre service de messagerie. En quelques secondes vous pouvez donc écrire votre mail et l’envoyer à votre destinataire. Besoin de modifier votre messagerie par défaut ? Vous pouvez sélectionner une nouvelle boîte mail favorite à tout moment, depuis notre plugin. Le plugin protège vos données personnelles et ne stocke pas d’historique de navigation. En installant « Choix messagerie », vous acceptez notre politique de confidentialité.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	6

Extension Version	Code Review Findings
1.0	6

Files with findings

2 distinct paths — top paths by unique finding count:

newOpenMailContentScript.js4
newOpenMailBackground.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	newOpenMailContentScript.js (line 68)	The content script reads a base64-encoded value from the visited page's `localStorage` under the key `opennewmail`, decodes it with `atob()`, stores it in Chrome sync storage, and then injects it directly into the pag…	1.0
2	Code Injection	high	newOpenMailBackground.js (line 37)	When a mailbox URL is updated, the background script queries all open tabs and broadcasts the new URL to every content script instance simultaneously. This cross-tab messaging pattern means any page can trigger the up…	1.0
3	Code Injection	high	newOpenMailContentScript.js (line 131)	The content script reads `opennewmail` from Chrome sync storage on every page load and assigns the result directly to `newOpenMailData`, which is subsequently used as the `innerHTML` payload. Since sync storage is sha…	1.0
4	Credential Theft	high	newOpenMailContentScript.js (line 3)	The content script, injected into every page (`<all_urls>`), defines a function that reads `document.cookie` on the host page. While the function is not visibly called in the reviewed code, its presence on every page …	1.0
5	Tracking	high	newOpenMailContentScript.js (line 121)	The content script also defines a cookie-writing function that can set arbitrary cookies on any visited page. Combined with the cookie-reading function, this provides a full cookie manipulation capability across all s…	1.0
6	Tracking	medium	newOpenMailBackground.js (line 1)	On installation, the extension silently opens a tab to `choix-messagerie.com/info/success`, a third-party domain. This is a tracking beacon that registers the install event with an external server, allowing the extens…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.choix-messagerie.com	/info/success	https://www.choix-messagerie.com/info/success
mail.google.com	/mail/u/0/	https://mail.google.com/mail/u/0/?view=cm&fs=1&to=_EMAIL_&tf=1
compose.mail.yahoo.com	-	https://compose.mail.yahoo.com/?to=_EMAIL_
outlook.live.com	/mail/0/deeplink/compose	https://outlook.live.com/mail/0/deeplink/compose?to=_EMAIL_

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Choix messagerie

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating