Chrome Web StoreCaution required
Suspicious in code review (v7.0.5)
Our reviewer found behaviour consistent with malware in version 7.0.5, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
44 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
CrxMouse: Mouse Gestures, used by 700,000 people, is rated caution by Extension Auditor. Our code review reported 3 findings (2 critical, 1 high), led by network interception. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.
Key findings
- Critical
Network Interception
The code overrides native WebSocket, fetch, and XHR constructors to capture all response data from any webpage. It dispatches the data via custom events, which are then processed by the extension's rule engine. This allows the extension to intercept and exfiltrate network traffic without user consent.
- Critical
Data Exfiltration
The WwI module loads rules from extension storage, checks if the current page matches a target URL, and if so, sets a localStorage hash to enable the network interception defined in. It then subscribes to the intercepted data and processes it using a rule engine, eventually sending the extracted information via a background message. This indicates the extension can be remotely configured to intercept and exfiltrate data from specific websites.
- High
Data Exfiltration
The Zeh module scrapes web page content based on rules fetched from extension storage. It extracts data from the DOM using a custom rule engine and, if certain conditions are met, sends the extracted data to the background via chrome.runtime.sendMessage. This allows the extension to exfiltrate page contents without clear user disclosure.
Analyst notes
The extension contains code to intercept all fetch, XHR, and WebSocket responses on any website, dispatch captured data to internal listeners, and exfiltrate it via background service worker. It also scrapes page content based on locally stored rules. This behavior is not disclosed in the CWS description or the listed data collection categories (Web history, User activity), and is unnecessary for the stated mouse gesture functionality. The ML risk score of 0.00 is likely a false negative due to the extension's benign appearance and user base.
CrxMouse: Mouse Gestures Chrome extension security report
ID: jlgkpaicikihijadgifklkbpdajbkhjo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://crxmouse.com/
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
44 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Boost browsing productivity with mouse gestures! Super Drag, Wheel & more for effortless navigation.
Read the publisher’s full description
Take control of your browsing with intuitive mouse gestures! CrxMouse supercharges your web experience with powerful mouse shortcuts. Effortlessly navigate, search, and open tabs with simple hand movements, saving you clicks and boosting your browsing efficiency. CrxMouse makes browsing: 🏎️ Faster: Navigate webpages and open links in a flash with customizable mouse gestures. 🖱️ Simpler: Ditch the keyboard shortcuts! Intuitive mouse movements take the effort out of browsing. 🕒 More Productive: Spend less time clicking and more time getting things done. CrxMouse offers: ⚙️ Easy-to-use mouse gestures: Get started quickly with pre-built options or create your own custom shortcuts. 🔎 Super drag: Drag links to open new tabs, copy text and URLs, and search in new tabs. 👆 Cursor Customization: Make browsing yours! Upload your own mouse cursor image for a unique and personalized touch. Take your browsing to the next level with CrxMouse! **Our service is free. No paid edition or account and no advertisements. Please note: Mouse gesture navigation doesn't work on Chrome's built-in pages because of Google's security restrictions. Mouse Gesture Built-in Actions: Press + Hold Right Button (anywhere on the screen) and Drag to perform the following: ↓→ : close current tab ↓→↑ : open a new window ← : back ←↑ : reopen closed tabs → : forward →↓ : scroll to bottom →↑ : scroll to top ↑ : scroll up one page ↑↓ : refresh ↑↓↑ : force a refresh ↑← : move to the left tab ↑→ : move to the right tab ↓→↓ : close current window -------------------------------- Super Drag Built-in Actions: Press + Hold Left Button and drag links to perform the following actions: → : open link in a new tab ← : open link in a new tab (background) ←↓→ : copy text →↓← : copy URL Press + Hold Left Button and drag text to perform the following actions: ← : search in new tab (background) → : search in a new tab -------------------------------- Wheel Gestures Built-in Actions: Press + Hold Right Button and scroll to perform the following actions: ↑: scroll to top Press + Hold Left Button and Scroll to perform the following actions: ↓: scroll to bottom Try these mouse gestures on our game - The Mouse Chase! 🐭 https://crxmouse.com/the-mouse-chase-1/ -------------------------------- We care greatly about your privacy. For more information, please read our privacy policy: https://crxmouse.com/privacy/
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
44 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Workflow & Planning
- Application Launcher For Drive (by Google)87,000,000 users
- AdBlock — block ads across the web65,000,000 users
- Chrome Remote Desktop38,000,000 users
- Microsoft Single Sign On35,000,000 users
- MetaMask14,000,000 users