Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Chrome Safe

CRITICAL RISKRemoved from Chrome Web Store

Chrome Safe

ID: phahokgoeemgffhnohpagbigjlgloipl

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.4

Size

0.19 MB

Rating

0.0/5

Reviews

Users

80,000

Type

Extension

Updated

May 20, 2020

Publisher Contextual Analysis

Author: officextensionsView Profile

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

80,192

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Blocks unsafe sites

Our extension makes page locks malicious reports reported by other users. Install the Chrome Safe security module now. This module is completely free, with no future charges. Compatible with Chrome Desktop browsers. Browse the safest internet.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-20%(-20,000 users)

Compared to 4 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High1

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.4 Code review	4

Extension Version	Code Review Findings
0.4	4

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js2
js/rp.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/rp.js (line 40)	The content script receives a 'load' command from the background page, parses arbitrary HTML from the server response, and injects it into the current page at a selector specified by the server. This allows complete r…	0.4
2	Data Exfiltration	critical	js/rp.js (line 11)	A hidden iframe is injected into the page with a URL provided by the background page (ultimately from the remote server). When 'get_return' is true, the entire HTML content of the iframe is extracted and sent back to …	0.4
3	Data Exfiltration	critical	js/background.js (line 66)	Exfiltrated iframe content from the content script is POSTed directly to the external server without user knowledge or consent.	0.4
4	Network Interception	high	js/background.js (line 91)	The extension intercepts all outgoing HTTP/HTTPS requests and, when a 'ref' value (received from the remote server) is present, overwrites or adds a Referer header using the decoded base64 value. This allows spoofing …	0.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
b.linksverify.com	/api/adcheck3	https://b.linksverify.com/api/adcheck3
b.linksverify.com	/api/pagecheck	https://b.linksverify.com/api/pagecheck
b.linksverify.com	/api/setinstalledcookie	https://b.linksverify.com/api/setinstalledcookie
jqueryui.com	-	http://jqueryui.com

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Chrome Safe

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating