Chrome Web Store
57Versions
1Code reviewed

No malware found

In code review (v5.15.1)

Our reviewer read version 5.15.1 β€” the most recent version we have reviewed β€” and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

CSFloat Market Checker, used by 1,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in October 2026.

The extension is a legitimate CS: trading tool. All permissions (scripting, declarativeNetRequest, offscreen, host_permissions on Steam) are required for its core functionality of injecting UI, modifying headers for trade offers, and running WASM-based notary proofs. Network requests go to the publisher's own API () and related services (, reverse.watch) that are integral to the extension's purpose. The 'wasm-unsafe-eval' is needed for the TLS-N prover. No actual data exfiltration, remote code loading, or unauthorized data collection beyond the disclosed functionality was found.

CSFloat Market Checker

CSFloat Market Checker Chrome extension security report

ID: jjicbefpemnphinccgikpdaagjebbnhg

Supported Languages

πŸ‡ΊπŸ‡ΈEnglish

Extension Info & Metadata

Status
Active
Version
5.18.0
Size
6.76 MB
Rating
3.9/5
Reviews
462
Users
1,000,000
Type
Extension
Updated
Oct 1, 2026
Category
Tools
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
2extensions
1 no longer listed
Scanned by Extension Auditor β€” Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
CSFloat Inc.
Country
US
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Address
1111B S Governors Ave STE 6886 Dover, DE 19904-6903 US
Website
Visit
Extensions
2
Active
1
Obsolete
1
Listed
1
Unlisted
1
Users
1,002,000

Email Change History

1 change
Sep 18, 2024
Domain changed

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
declarativeNetRequestWithHostAccess
Permission
Critical
This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules.
offscreen
Permission
High
This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: β€’ 19% increase: Access to sensitive domains increases potential impact β€’ 25% increase: Unsafe code evaluation capabilities increase attack surface
Unsafe WebAssembly Execution
Risk Factor
High
This extension's CSP allows "wasm-unsafe-eval".
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
*://*.steamcommunity.com/market/listings/730/*
Host
Medium
Host permission β€” access limited to this URL pattern.
*://*.steamcommunity.com/id/*/inventory*
Host
Medium
Host permission β€” access limited to this URL pattern.
*://*.steamcommunity.com/id/*/tradehistory*
Host
Medium
Host permission β€” access limited to this URL pattern.
*://*.steamcommunity.com/profiles/*/inventory*
Host
Medium
Host permission β€” access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: *://*.steamcommunity.com/market/listings/730/*
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

Shows the float value, paint seed, and more of Counter-Strike (CS:GO & CS2) items on the Steam Market or Inventories

Read the publisher’s full description

CSFloat Market Checker uses the dedicated CS Float (formerly CSGO Float) API to allow you to retrieve the float values, 3d models, and screenshots of market items directly from the page! GitHub: https://github.com/csfloat/extension Note: Items queried will be ranked on FloatDB (csfloat.com) Features: * Allows verification for trades on CSFloat Market * Allows you to retrieve the float, paint seed, and float rank of any market or inventory item * Allows you to fetch the 3D model and screenshot of the item directly on the page * Fetches all floats on the page fast and automatically on page load * User-definable filters to highlight items with low floats or certain paint seeds * Shows market item stickers at a glance and their wear * Change the amount of items on the page up to 100 Compatibility: * This extension has been tested to work with Steam Inventory Helper and Enhanced Steam * Since this extension doesn't hook and modify HTTP headers to bypass steamcommunity.com CSP, it should have greater compatibility with other extensions. Please report issues using our GitHub issue tracker (https://github.com/csfloat/extension/issues).

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
5.18.0
Latest
6.76 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.9.5
7.79 MBNot scannedβ€”
00db43b1c55ffbe04889fbf4da3200ac66252fa5ed1df7c7da8868f496875bfc
5.17.0
6.59 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.16.0
6.52 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.15.1
7.04 MBNo malware found0
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.15.0
7.04 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.14.0
6.98 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.13.0
6.97 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.12.0
6.37 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
5.11.0
6.37 MBNot scannedβ€”
4a80f17bd4484635a2639be8b0e0f93fa37885f4bc880ba25889ef02b8a74342
Showing 1 to 10 of 60 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.