Security Alert: Confirmed Malware
Clicca e-mail
ID: clpbkfliohlemmhknoikemoecpjnpded
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- francobertelottiView Profile
Salva gli indirizzi e-mail che vuoi
Utilizza il nostro plugin per copiare con facilità un indirizzo e-mail negli appunti. · Devi copiare un indirizzo e-mail in una conversazione o un documento Word? · Devi creare una lista di indirizzi e-mail senza inviare dei messaggi? · Devi recuperare l’indirizzo e-mail di un sito di e-commerce senza utilizzare il modulo dell’Assistenza clienti? · Devi copiare un indirizzo e-mail per utilizzarlo con un altro servizio di messaggistica? … Una volta installata sul tuo browser, l’estensione “Clicca e-mail” ti permette di recuperare gli indirizzi e-mail di qualsiasi pagina web! Cliccando semplicemente su un indirizzo o sul pulsante di un modulo di contatto puoi copiare il contatto e-mail nella cronologia del plugin (accessibile a destra del menu del browser). Riutilizza all’infinito gli indirizzi e-mail della tua lista facendo clic sull’icona Copia/Incolla a destra di ciascun indirizzo. Hai copiato un indirizzo e-mail per errore? Niente panico! Puoi cancellarlo in qualsiasi momento facendo clic sul cestino. Il plugin tutela i tuoi dati personali e non archivia gli indirizzi e-mail copiati. Installando ”Clicca e-mail”, accetti la nostra informativa sulla privacy. https://www.clicca-email.com/info/privacy-policies
The extension reads a base64-encoded value from the current page's localStorage under the key 'mailtoclipboard', decodes it with atob(), and injects the result as innerHTML. Critically, when the toSave flag is set, this payload is also persisted to chrome.storage.sync. Because the content script runs on all URLs, a malicious site could plant a base64-encoded HTML payload in localStorage, causing the extension to inject it into every page the user subsequently visits — a persistent cross-site injection vector. Event-handler-based XSS (e.g. <img onerror=...>) would execute in each victim page's context. There is no evidence the developer is exploiting this; it appears to be a poorly conceived legacy-migration fallback.
this.mailClipboardInit = function() { ... if (localStorage.getItem("mailtoclipboard") != null && this.mailClipboardData.element == undefined) { this.mailClipboardData.element = atob(localStorage.getItem("mailtoclipboard")); this.mailClipboardData.toSave = true; } mailClipboardEl.innerHTML = this.mailClipboardData.element || ''; mailClipboardPageBody.appendChild(mailClipboardEl); if (myMail.mailClipboardData.toSave) { chrome.storage.sync.set({ "mailtoclipboard": myMail.mailClipboardData }); }};Two cookie manipulation functions (set and get) are defined in the content script but never called anywhere in the codebase. Dead code with cookie access on all URLs is a minor hygiene concern but not itself malicious — there is no call site, no data is read or written to cookies, and no exfiltration occurs. Most likely abandoned code from an earlier version of the extension.
this.mailClipboardSetCookie = function(cname, cvalue) { const date = new Date(); date.setTime(date.getTime() + (60 * 60 * 1000)); document.cookie = cname + "=" + cvalue + "; expires=" + date.toGMTString() + "; path=/;";};...this.mailClipboardGetCookie = function(cname) { cname = cname + "="; let rv = ""; decodeURIComponent(document.cookie) .split(';') .forEach(c => { c = c.trim(); if (c.indexOf(cname) == 0) { rv = c.substring(cname.length, c.length); } }); return rv;};By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0 | 2 |
Files with findings
1 distinct path — top paths by unique finding count:
- mailClipboardContentScript.js2
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.