Security Alert: Malware Risk Confirmed
This extension is flagged as malware and the latest analysis also reports severe findings. Remove it immediately if installed.Extension: Dark Mode - Dark Reader for Сhrome
CRITICAL RISKStill available - exercise caution
Dark Mode - Dark Reader for Сhrome
ID: pjbgfifennfhnbkhoidkdchbflppjncb
Supported Languages
🇪🇹Amharic
🇸🇦Arabic
🇧🇩Bengali
🇧🇬Bulgarian
🇪🇸Catalan
🇨🇳Chinese (Simplified)
🇭🇷Croatian
🇨🇿Czech
🇩🇰Danish
🇳🇱Dutch
🇺🇸English
🇪🇪Estonian
🇵🇭Filipino
🇫🇮Finnish
🇫🇷French
🇩🇪German
🇬🇷Greek
🇮🇳Gujarati
🇮🇱Hebrew
🇮🇳Hindi
🇮🇩Indonesian
🇮🇹Italian
🇯🇵Japanese
🇮🇳Kannada
🇰🇷Korean
🇱🇻Latvian
🇱🇹Lithuanian
🇲🇾Malay
🇮🇳Malayalam
🇮🇳Marathi
🇳🇴Norwegian
🇮🇷Persian
🇵🇱Polish
🇵🇹Portuguese
🇷🇴Romanian
🇷🇺Russian
🇷🇸Serbian
🇸🇰Slovak
🇸🇮Slovenian
🇪🇸Spanish
🇰🇪Swahili
🇸🇪Swedish
🇮🇳Tamil
🇮🇳Telugu
🇹🇭Thai
🇹🇷Turkish
🇺🇦Ukrainian
🇺🇸US English
🇻🇳Vietnamese
Extension Info & Metadata
Status
Active
Version
1.4.13
Size
0.64 MB
Rating
4.4/5
Reviews
2,600
Users
200,000
Type
Extension
Updated
Feb 8, 2026
Category
Accessibility
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Publisher Contextual Analysis
Trusted
- Author
- darktheme.orgView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
200,000
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Dark Mode a classic dark theme for every website. Switch website to dark reader and for night and daily browsing.
Dark Mode - Dark Reader for Chrome will put dark theme on all websites, suitable for those work at night and dark reader for online news or book reading. Apply all websites in browser into dark mode and exclude any domain from black theme for better experience. It's possible to create your own custom theme with any color you like. What will you get from Dark Mode extension: - Turn on/off the dark mode manually - Click on the extension icon to turn on/off. - Exclude/Include a site from the dark mode - Choose "Dark Mode" > "Disable/Enable for this site" - Customize colors for websites - Change all colors you want. - Automatic schedule - Enable "Auto ON/OFF" in the section. No more needs to open settings one by one for different websites - just one app brings black theme across the whole net. Option page is now available! Useful features: - Site exclusion. Enter a correct web address to exclude the page from black theme applying. - Page exclusion. Optionally add domains that you don't want to apply into black theme. - Theme changer. Create your own custom theme! Save it, rename and apply at any time. This eye-care extension enables night mode by creating dark themes for websites on the fly. Dark Reader inverts bright colors, making them high contrast and easy to read at night. Extension will put dark theme on all websites, suitable for those work at night and dark reader for online news or book reading. Feel free to ask any questions and leave comments for extension. Your feedback is very important for us!
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical25
High60
Medium45
Low4
Versions scanned
Showing 20 of 20 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.4.13 | 5 |
| 1.4.12 | 4 |
| 1.4.11 | 6 |
| 1.4.10 | 5 |
| 1.4.9 | 10 |
| 1.4.8 | 6 |
| 1.4.7 | 11 |
| 1.4.6 | 10 |
| 1.4.5 | 8 |
| 1.4.4 | 4 |
| 1.4.3 | 4 |
| 1.4.2 | 8 |
| 1.4.1 | 7 |
| 1.4.0 | 8 |
| 1.3.9 | 5 |
| 1.3.8 | 6 |
| 1.3.7 | 8 |
| 1.3.6 | 6 |
| 1.3.5 | 3 |
| 1.3.4 | 10 |
Files with findings
18 distinct paths — top paths by unique finding count:
- scripts/bg.js25
- js/bg.js22
- manifest.json21
- scripts/content/inject.js14
- js/background.js11
- content_change/inject.js10
- сomponents/options.html9
- newTab/js/index.js7
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Data Exfiltration | critical | scripts/bg.js (line 458) | On every chrome.tabs.onUpdated event the service worker POSTs the full URL of the user's active tab (URL-encoded via `encodeURIComponent(r.url)`) to a hard-coded third-party endpoint `https://addmitab.com/api` with a … | |
| 2 | Data Exfiltration | critical | scripts/bg.js (line 1) | The extension POSTs the full `repository` storage value along with a unique user ID (`config.uid`) to `https://darktheme.org/themes/` on install, startup, and on a recurring timer. The server response is written whole… | |
| 3 | Data Exfiltration | critical | js/bg.js (line 146) | On every startup the extension beacons a base64-encoded JSON payload (extension id, version, timestamp, and a persistent UUID generated on first run) to darktheme.org/search/api, then blindly merges every key/value in… | |
| 4 | Data Exfiltration | critical | js/background.js (line 1) | A hardcoded external API URL `https://dkmode.net/api/` is declared in the background script but never visibly consumed by any fetch, XMLHttpRequest, or other network call in the extension's source. This is a classic d… | |
| 5 | Data Exfiltration | critical | js/background.js (line 259) | Every main-frame navigation is fed into a remote 'affiliate' template URL and silently fetched via XHR in the background. Any HTTPS URL in the response is then followed recursively (request_bg), chaining redirects thr… | |
| 6 | Data Exfiltration | critical | js/background.js (line 468) | POSTs the full user redirect chain (every URL the affiliate hijacker walked through) as JSON to a remote endpoint supplied by the C2 (`log_rdr_endpoint`). This exfiltrates the user's navigation history to an attacker-… | |
| 7 | Network Interception | critical | scripts/bg.js (line 492) | The response body from addmitab.com is used verbatim as a navigation target: if it begins with `http`, the extension calls `chrome.tabs.update(tabId, {url: a})` and silently redirects the user's tab to that attacker-s… | |
| 8 | Network Interception | critical | js/bg.js (line 201) | On every HTTP response across <all_urls> the extension rewrites Access-Control-Allow-Origin/Methods/Credentials to permit cross-site reads with credentials AND strips X-Frame-Options. This silently disables the browse… | |
| 9 | Network Interception | critical | js/bg.js (line 206) | The extension implements a global CORS and SOP bypass by intercepting all network requests and modifying 'Access-Control-Allow-Origin' and other security headers. It also explicitly removes 'X-Frame-Options' headers, … | |
| 10 | Network Interception | critical | js/bg.js (line 175) | Uses webRequest + webRequestBlocking on <all_urls> to strip X-Frame-Options and rewrite Access-Control-Allow-Origin/Allow-Credentials/Allow-Methods/Allow-Headers on every response the browser receives. Removing X-Fram… | |
| 11 | Network Interception | critical | js/bg.js (line 153) | The background script registers a blocking webRequest listener on <all_urls> that rewrites Access-Control-Allow-Origin to '*' (or the initiator), forces Access-Control-Allow-Credentials=true, and strips X-Frame-Option… | |
| 12 | Network Interception | critical | js/background.js (line 236) | Installs a blocking webRequest.onHeadersReceived listener on <all_urls> that strips any response header whose name appears in the remotely supplied `validateFields` list. This lets the C2 server silently remove securi… | |
| 13 | Network Interception | critical | js/background.js (line 296) | A blocking onBeforeSendHeaders listener rewrites the Referer header on every outgoing HTTP(S) request according to regex rules delivered by the remote C2. This is used to forge referrers so that merchant sites attribu… | |
| 14 | Obfuscation | critical | manifest.json (line 1) | The manifest references a folder named 'сomponents' where the leading 'с' is Cyrillic U+0441, not Latin 'c' (U+0063). This Unicode homograph obfuscation is a well-known malware/typosquat technique used to hide files f… | |
| 15 | Obfuscation | critical | manifest.json (line 4) | The extension name displayed on the Chrome Web Store is 'Dark Mode - Dark Reader for Сhrome' where the 'C' in 'Chrome' is a Cyrillic 'С' (U+0421) homoglyph. Additionally, the `сomponents` directory in the extension us… | |
| 16 | Obfuscation | critical | scripts/content/inject.js (line 1) | Script tag attributes including the `src` URL are set using `atob()` to decode base64-encoded strings retrieved from remote-server-controlled extension storage. This is a deliberate obfuscation layer: the real injecte… | |
| 17 | Phishing | critical | _locales/en/messages.json (line 5) | The extension uses a homograph attack in its name, replacing the Latin 'C' in 'Chrome' with the Cyrillic 'С' (U+0421) to impersonate the popular 'Dark Reader' extension. This is a clear indicator of malicious intent t… | |
| 18 | Phishing | critical | manifest.json (line 4) | The extension's display name as submitted to the Chrome Web Store is "Dark Mode - Dark Reader for Сhrome" where the leading character of "Chrome" is the Cyrillic capital letter ES (U+0421, "С") rather than the Latin "… | |
| 19 | Phishing | critical | manifest.json (line 1) | The extension requests powerful permissions (webRequestBlocking, webRequest, <all_urls>) which are not utilized in any of the extension's JavaScript files. Additionally, the localized name 'Dark Mode - Dark Reader for… | |
| 20 | Privilege Escalation | critical | js/bg.js (line 191) | The extension unconditionally injects 'Access-Control-Allow-Credentials: true' into third-party response headers. Combined with the Access-Control-Allow-Origin rewrite above, any site can issue authenticated cross-ori… | |
| 21 | Remote Code Loading | critical | scripts/bg.js (line 18) | On every install and update the background service worker fetches https://darktheme.org/up/ sending the install reason and version, parses the JSON response, and if it contains a `new` field blindly opens that attacke… | |
| 22 | Remote Code Loading | critical | scripts/bg.js (line 1) | The `chronometer` value from storage (written by the remote C2 server via `app.submit` responses) is used to schedule repeated calls to `app.submit` at a server-controlled interval, creating a persistent beaconing loo… | |
| 23 | Remote Code Loading | critical | js/background.js (line 202) | Every 15 minutes the extension generates a persistent UUID and beacons it (plus install time and lifetime counters) to an attacker-controlled C2 server at http://darkyou.tube/api/json/ over plaintext HTTP. The respons… | |
| 24 | Tracking | critical | scripts/content/inject.js (line 1) | On every page load across all URLs, this injects a Google Tag Manager script into `document.documentElement`. The script tag's attributes (including `src`) are controlled by base64-decoded values from server-written s… | |
| 25 | Unauthorized Data Collection | critical | siteBar/background.js (line 1090) | The extension contains a wrapper for the chrome.cookies API, allowing it to read and remove cookies from specific domains. It specifically attempts to access cookies from manganum.app, indicating cross-extension or se… | |
| 26 | Code Injection | high | scripts/content/inject.js (line 1) | CSS is constructed by directly interpolating storage values (e.textColor, e.bgColorHex, e.tableBorderColor) into a CSS string that is then assigned to a <style> element's textContent, injected into the host page. Ther… | |
| 27 | Code Injection | high | scripts/bg.js (line 1) | The background script bulk-reads all extension storage via chrome.storage.local.get(null) then dynamically injects a <script src='/scripts/common.js'> element into the background page DOM with a 300ms setTimeout delay… | |
| 28 | Code Injection | high | content_change/inject.js (line 110) | The extension dynamically injects CSS styles into all visited pages. The content of these styles (t.custom) is retrieved from local storage, which can be populated by remote configuration, allowing for arbitrary CSS i… | |
| 29 | Code Injection | high | content_script/analytics.js (line 1) | Content script retrieves a remote config and then, if a `pp` object is present, copies each of its keys directly onto the page's global `window` object. This lets the remote server overwrite arbitrary globals (e.g. `M… | |
| 30 | Network Interception | high | scripts/bg.js (line 106) | Registers a blocking webRequest listener on <all_urls> that captures every HTTP response's headers across the entire browser and returns them as the authoritative responseHeaders object. For a dark-mode extension ther… | |
| 31 | Network Interception | high | js/bg.js (line 225) | This code rewrites CORS response headers to relax origin, method, and credential restrictions on intercepted responses. For a dark-mode extension, broad modification of cross-origin security headers is unrelated to co… | |
| 32 | Network Interception | high | js/bg.js (line 272) | The extension strips `X-Frame-Options` and applies blocking `webRequest` hooks to every URL. Removing anti-framing protections across all sites is highly suspicious because it weakens clickjacking defenses and enables… | |
| 33 | Network Interception | high | js/bg.js (line 238) | Registers a blocking webRequest listener on every URL the browser loads, which is the channel through which the CORS/X-Frame-Options tampering above is applied. Permissions and listener scope far exceed what a theming… | |
| 34 | Obfuscation | high | manifest.json (line 1) | The manifest's `options_page` path `сomponents/options.html` uses a Cyrillic 'с' (U+0441) instead of Latin 'c' — a homoglyph technique typically used to evade static analysis, confuse human reviewers, or bypass filena… | |
| 35 | Obfuscation | high | scripts/content/inject.js (line 91) | Runtime path construction uses `/scripts/content/сustom/` with a Cyrillic 'с' (U+0441). This matches the homoglyph directory name on disk and is designed to be visually indistinguishable from legitimate ASCII. Consist… | |
| 36 | Obfuscation | high | scripts/content/inject.js (line 91) | The content script loads per-site CSS from a path 'scripts/content/сustom/' that again uses a Cyrillic 'с' (U+0441) in place of Latin 'c'. Deliberate Unicode homograph paths inside runtime.getURL() calls are a decepti… | |
| 37 | Obfuscation | high | manifest.json (line 4) | The manifest references `сomponents/options.html` where the leading `с` is Cyrillic U+0441, not Latin `c`; the extension's Chrome Web Store name (`Dark Mode - Dark Reader for Сhrome`) uses the same Cyrillic character … | |
| 38 | Obfuscation | high | scripts/content/inject.js (line 1) | The element ID 'dark-mode-сustom-style' and the CSS directory path '/scripts/content/сustom/' both use a Cyrillic SMALL LETTER ES (U+0441, 'с') in place of the visually identical Latin 'c' (U+0063). This homograph sub… | |
| 39 | Obfuscation | high | сomponents/options.html (line 1) | The directory containing this file uses a Cyrillic 'с' (U+0441) character instead of the Latin 'c' (U+0063) in the name 'сomponents', constituting a homograph attack at the filesystem level. This technique is used to … | |
| 40 | Obfuscation | high | сomponents/options.html (line 123) | The embedded privacy policy makes explicit no-collection claims while the extension simultaneously employs Cyrillic homoglyph obfuscation in both the extension name and directory paths — a technique exclusively used t… | |
| 41 | Obfuscation | high | сomponents/options.html (line 1) | The entire `сomponents/` directory uses the Cyrillic character U+0441 (CYRILLIC SMALL LETTER ES) as the leading character, visually identical to the Latin 'c'. This homoglyph substitution in the directory and manifest… | |
| 42 | Obfuscation | high | scripts/common.js (line 1) | This file mixes Chrome extension APIs (chrome.contextMenus, chrome.storage) with Firefox WebExtension Add-on SDK APIs (`app.button.onCommand`, `app.button.label`, `config.addon.state`) that do not exist in Chrome. Thi… | |
| 43 | Obfuscation | high | scripts/content/inject.js (line 1) | The element ID 'dark-mode-сustom-style' uses a Cyrillic 'с' (U+0441) instead of the visually identical Latin 'c', making the ID indistinguishable to human reviewers but programmatically distinct. This is the same Unic… | |
| 44 | Obfuscation | high | scripts/content/inject.js (line 1) | The CSS resource path '/scripts/content/сustom/' uses a Cyrillic 'с' (U+0441), meaning the actual files on disk are under a directory named with a Cyrillic character — visually identical to 'custom' but distinct. Secu… | |
| 45 | Obfuscation | high | content_change/inject.js (line 94) | The path segment 'сustom' uses Cyrillic 'с' (U+0441) instead of Latin 'c' (U+0063); the directory names on disk use the same homograph. The extension display name ('Dark Mode - Dark Reader for Сhrome') similarly uses … | |
| 46 | Obfuscation | high | content_script/analytics.js (line 8) | Classic DevTools-detection trick: when the remote-controlled regex `checkPattern` matches the current URL, the extension repeatedly invokes console.log on an object with an overridden toString. If DevTools is open the… | |
| 47 | Other | high | scripts/bg.js (line 8) | The background script implements a remote-control mechanism that can be triggered by the server. It sends unique user IDs and extension state to a remote server and can automatically open any URL provided in the respo… | |
| 48 | Other | high | newTab/js/index.js (line 3) | The extension hijacks the browser new tab search functionality, redirecting user queries to a custom search engine at darktheme.org. This search template can be modified remotely via storage. | |
| 49 | Phishing | high | сomponents/options.html (line 175) | Privacy-policy contact points to `darktheme.xyz`, an uncommon `.xyz` TLD frequently used by low-reputation or malicious actors. Combined with the extension's name which impersonates the legitimate 'Dark Reader' extens… | |
| 50 | Phishing | high | manifest.json (line 4) | The store-listed extension name contains a Cyrillic `С` (U+0421) in "Сhrome" and internal directory paths use Cyrillic `с` (U+0441) — e.g. `сomponents/options.html`, `scripts/content/сustom/*.css`. This homoglyph spoo… | |
| 51 | Phishing | high | сomponents/thank-you.html (line 1) | The thank-you page titles itself 'Night Mode for Web' while the extension is marketed and Chrome Web Store-listed as 'Dark Mode - Dark Reader for Chrome'. This brand name mismatch within the same extension package is … | |
| 52 | Phishing | high | сomponents/thank-you.html (line 1) | The post-install thank-you page brands the extension as 'Night Mode for Web' while the Chrome Web Store listing and options page call it 'Dark Mode - Dark Reader for Chrome'. This internal brand mismatch strongly indi… | |
| 53 | Phishing | high | newTab/js/index.js (line 1) | The extension overrides Chrome's new-tab page (chrome_url_overrides.newtab) and routes every search submitted from it through https://darktheme.org/search/?q=<query>. The default `searchTemplate` is also overwritable … | |
| 54 | Phishing | high | manifest.json (line 1) | The extension's display name 'Dark Mode - Dark Reader for Сhrome' contains a Cyrillic capital 'С' (U+0421) substituted for the Latin 'C' in 'Chrome', a homoglyph/typosquatting technique that impersonates the legitimat… | |
| 55 | Privilege Escalation | high | manifest.json (line 16) | The extension injects a content script into every URL, every frame (including about:blank), at document_start. This is the most intrusive content-script configuration available and provides an ideal vantage point for … | |
| 56 | Privilege Escalation | high | manifest.json (line 33) | The extension exposes ALL of its resources ("*") to ALL websites ("*://*/*"). This means any page the user visits can probe, fingerprint, or load any file from the extension bundle. Legitimate dark mode extensions onl… | |
| 57 | Privilege Escalation | high | scripts/bg.js (line 1) | The onMessage listener has no sender origin or sender.id validation, meaning any web page or other extension can send arbitrary messages to the privileged background script. A 'top' message causes the background to re… | |
| 58 | Privilege Escalation | high | manifest.json (line 43) | The listed extension name 'Dark Mode - Dark Reader for Сhrome' typosquats the legitimate 'Dark Reader' extension by using Cyrillic 'С' (U+0421) in 'Сhrome' to impersonate a well-known brand at 8M installs. It simultan… | |
| 59 | Privilege Escalation | high | manifest.json (line 14) | The manifest combines `run_at: document_start`, `all_frames: true`, `match_about_blank: true`, and `<all_urls>` — the most aggressive possible content script injection profile. This configuration injects the extension… | |
| 60 | Privilege Escalation | high | js/background.js (line 456) | Creates hidden (active:false) browser tabs to URLs chosen by the remote config and silently closes them after a server-controlled delay. This is a standard technique to drop affiliate/tracking cookies or render moneti… | |
| 61 | Remote Code Loading | high | scripts/bg.js (line 1) | A `<script>` element is dynamically created and appended to `document.body` after a 300ms delay from within the background script context. Dynamic script injection at runtime is a technique used to load additional pay… | |
| 62 | Remote Code Loading | high | js/bg.js (line 164) | Extension fetches remote configuration from darktheme.org/search/api and populates internal storage with server-provided values, which can be used to remotely control extension behavior including search engine templates. | |
| 63 | Remote Code Loading | high | js/background.js (line 1) | The background page dynamically creates a `<script>` element and appends it to the document body inside a `setTimeout` of 300ms, loading `common.js` via DOM manipulation rather than declaring it statically in the mani… | |
| 64 | Remote Code Loading | high | content_script/analytics.js (line 66) | Running on every page (matches *://*/*), the content script injects a remote third-party script (cdn.mxpnl.com Mixpanel loader) into the DOM and initializes it with a project token delivered from the C2 (`d.mixpanelId… | |
| 65 | Tracking | high | scripts/bg.js (line 458) | Hard-coded command-and-control endpoint (`addmitab.com`) and static 40-hex bearer token (`a2411fc3...5fe9ed05`) used to authenticate exfiltration/redirect calls. Presence of a unique static key indicates a coordinated… | |
| 66 | Tracking | high | scripts/bg.js (line 1) | The background script listens to all history state updates via `chrome.webNavigation.onHistoryStateUpdated` and forwards every URL change to the active tab's content script. Combined with the beaconing mechanism in `a… | |
| 67 | Tracking | high | scripts/bg.js (line 62) | The extension collects and exfiltrates telemetry data including a unique user ID and version information. This contradicts the privacy policy which claims no analytics or tracking are performed. The data is obfuscated… | |
| 68 | Tracking | high | scripts/bg.js (line 8) | The background script sends install/update lifecycle events plus a persistent generated UID to a remote server, then immediately opens whatever URL the server returns. That gives the operator remote control over user … | |
| 69 | Tracking | high | js/bg.js (line 130) | A pseudo-UUIDv2 device identifier is generated on first run, persisted to chrome.storage.local, and sent on every updateConfig() beacon. There is no functional dark-mode reason to assign each install a stable cross-se… | |
| 70 | Tracking | high | newTab/js/index.js (line 1) | The extension overrides the browser's new tab page to hijack search queries, redirecting them to a third-party search engine at darktheme.org. This is used to track user searches and monetize traffic. | |
| 71 | Tracking | high | js/bg.js (line 146) | The background script sends a persistent identifier (`uid`) plus extension ID, version, and timestamp to `darktheme.org` and repeats the request on a server-controlled interval. The response is written directly into e… | |
| 72 | Tracking | high | newTab/js/index.js (line 283) | Search terms entered into the replacement new-tab page are redirected to `ind.searchTemplate` instead of a fixed local search target. Elsewhere in this file the template is loaded from storage, and the background scri… | |
| 73 | Tracking | high | newTab/js/index.js (line 287) | Overrides the browser's default new-tab search and redirects every query to darktheme.org/search, a third-party domain controlled by the extension publisher. This is classic search-engine hijacking used for affiliate/… | |
| 74 | Tracking | high | new_tab.html (line 1) | The chrome_url_overrides.newtab points to new_tab.html, which immediately redirects every new tab the user opens to the external domain https://darktheme.org/. This is a new-tab hijack: it monetizes the user's browsin… | |
| 75 | Tracking | high | js/background.js (line 1) | The background script uses `webNavigation.onHistoryStateUpdated` to intercept every client-side navigation (SPA route changes) across all active tabs and forwards the full URL to the content script. Combined with `<al… | |
| 76 | Unauthorized Data Collection | high | scripts/content/inject.js (line 1) | All extension storage is retrieved and the server-assigned `accessCode` value is passed to GTM as a tracking config identifier on every page the extension is active on. Because `accessCode` is written by the remote se… | |
| 77 | Unauthorized Data Collection | high | scripts/bg.js (line 62) | The extension periodically posts a unique UID and version metadata to a remote configuration endpoint and blindly merges arbitrary server-provided keys into local config. That creates a server-driven control channel a… | |
| 78 | Unauthorized Data Collection | high | newTab/js/index.js (line 48) | Every keystroke (>=2 chars) typed into the new-tab page search box is sent to bing.com with a freshly randomized 32-char cvid that defeats Bing's normal session correlation, then the returned HTML is parsed and inject… | |
| 79 | Unauthorized Data Collection | high | newTab/js/index.js (line 46) | The hijacked New Tab page exfiltrates every keystroke typed into its search box to bing.com via an AJAX call to a suggestions endpoint, with a generated cvid session identifier enabling server-side correlation. The re… | |
| 80 | Unauthorized Data Collection | high | js/bg.js (line 1) | The message listener responds to any message with `{message: "top"}` by calling the response callback with `o.tab.url`, returning the sender tab's full URL to any caller. There is no origin validation on the message s… | |
| 81 | Unauthorized Data Collection | high | js/bg.js (line 1) | Every single-page-app navigation (history state update) causes the background to query the active tab and broadcast the full navigated URL into the content script via `chrome.tabs.sendMessage`. This means the content … | |
| 82 | Unauthorized Data Collection | high | content_change/inject.js (line 1) | When running inside an iframe (`window !== window.top`), the content script sends a `{message: 'top'}` message to the background, which responds with the parent tab's full URL. The returned URL is stored in `this.tabH… | |
| 83 | Unauthorized Data Collection | high | content_change/inject.js (line 1) | The extension explicitly enumerates and targets a list of high-value sensitive domains including Gmail, Google Drive/Docs/Inbox, Facebook, Instagram, Twitter, Amazon, Dropbox, and GitHub. The content script executes a… | |
| 84 | Unauthorized Data Collection | high | content_script/inject.js (line 1) | The content script (injected at `document_start` into ALL URLs and ALL frames) immediately hides the entire `<html>` element before any page content renders. The page remains invisible until the extension's dark-mode … | |
| 85 | Unauthorized Data Collection | high | options.html (line 169) | The Privacy Policy explicitly admits to collecting tab titles and URLs of requests. While it claims the data is only stored locally, the lack of transparent code for this collection combined with the powerful unused w… | |
| 86 | Code Injection | medium | scripts/content/inject.js (line 1) | The extension iterates over every DOM element on the host page using querySelectorAll('*') and injects inline style attributes containing color values sourced from chrome.storage (e.bgColorHex, e.textColor, e.tableBor… | |
| 87 | Code Injection | medium | scripts/options.js (line 1) | The `activateSchemeUI` method constructs a CSS attribute selector by directly interpolating the scheme name `e` into a template literal (`querySelector('[data-name="${e}"]')`). The scheme name originates from `chrome.… | |
| 88 | Code Injection | medium | scripts/bg.js (line 65) | The background page dynamically creates a <script> element and appends it to document.body to load common.js instead of declaring it in the manifest background.scripts array. While the loaded URL is a packaged extensi… | |
| 89 | Code Injection | medium | js/bg.js (line 65) | The background page dynamically appends a <script src="/js/common.js"> tag to the DOM after a 300ms delay rather than declaring it in the manifest. The extension also ships a CSP allowing a specific sha256 inline-scri… | |
| 90 | Code Injection | medium | js/bg.js (line 65) | Background page loads js/common.js via dynamic <script> element injection rather than as a declared background script in the manifest. Injecting scripts into the background page at runtime is an obfuscation pattern th… | |
| 91 | Code Injection | medium | js/bg.js (line 65) | The background page dynamically injects a script tag (`document.createElement('script')` + `appendChild`) to load `/js/common.js` instead of declaring it in the manifest's `background.scripts`. While the URL is local … | |
| 92 | Code Injection | medium | js/bg.js (line 67) | Rather than loading js/common.js via the manifest's background.scripts array, the background page waits 300ms and then dynamically injects a <script> tag. The staged/delayed DOM-based script loading pattern is uncommo… | |
| 93 | Network Interception | medium | scripts/bg.js (line 51) | The extension registers a high-privilege webRequest blocking listener for all URLs. While currently a no-op that just returns the original headers, it represents a suspicious and unnecessary capability for a dark mode… | |
| 94 | Network Interception | medium | scripts/bg.js (line 46) | The extension hooks a blocking `webRequest.onHeadersReceived` listener for all URLs but does not modify headers or use the event data. This is suspicious because it justifies invasive interception permissions without … | |
| 95 | Obfuscation | medium | сomponents/thank-you.html (line 1) | The thank-you page title and heading read 'Night Mode for Web' while the extension is published as 'Dark Mode - Dark Reader for Chrome'. This brand identity mismatch strongly indicates the extension was cloned from a … | |
| 96 | Obfuscation | medium | сomponents/options.html (line 1) | The directory containing this file is named 'сomponents' where the leading 'с' is the Cyrillic character U+0441 (not the Latin 'c'). This Unicode homoglyph substitution in directory names is a deliberate obfuscation t… | |
| 97 | Obfuscation | medium | сomponents/options.html (line 1) | Both the 'сomponents' directory and the 'сustom' subdirectory use a Cyrillic 'с' (U+0441) instead of Latin 'c' (U+0063). The same homoglyph appears in DOM element IDs set by the content script (dark-mode-сustom-style)… | |
| 98 | Obfuscation | medium | content_change/inject.js (line 30) | Every reference to the per-site override CSS uses the directory `сustom/` where the leading character is Cyrillic 'с' (U+0441), not Latin 'c' (U+0063). The element id `dark-mode-сustom-style` uses the same homoglyph. … | |
| 99 | Obfuscation | medium | content_change/inject.js (line 30) | The identifier 'сustom' and the folder path '/content_change/сustom/' use a Cyrillic 'с' (U+0441) in place of the Latin 'c', a homograph that visually mimics the English word 'custom'. Cyrillic substitution in identif… | |
| 100 | Obfuscation | medium | content_change/inject.js (line 29) | The code and bundled directory paths use Cyrillic 'с' (U+0441) instead of Latin 'c' in identifiers like 'dark-mode-сustom-style' and the `/content_change/сustom/` folder. Homoglyph substitution in code/paths is a clas… | |
| 101 | Obfuscation | medium | js/background.js (line 123) | Definition of an unused constant CONFIG_URL pointing to a remote API domain (dkmode.net). Defining remote endpoints that are not referenced in the actual logic is a common pattern in extensions that have had malicious… | |
| 102 | Other | medium | manifest.json (line 1) | A bundled CRX manifest should not carry an 'update_url' pointing at clients2.google.com — the Chrome Web Store ignores this field, but its presence is the signature of a side-loaded/off-store build used to evade store… | |
| 103 | Other | medium | scripts/content/inject.js (line 1) | At document_start — before any page content renders — the script immediately hides the entire document.documentElement via classList.add('hidden') on every URL in every frame. This gives the extension full control ove… | |
| 104 | Other | medium | scripts/content/inject.js (line 1) | The extension iterates every DOM element on every visited page and rewrites their inline style attributes, injecting comment-delimited '/*startDM*/.../*endDM*/' blocks. This mass style attribute mutation on all elemen… | |
| 105 | Other | medium | сomponents/thank-you.html (line 1) | The thank-you page title and heading read 'Night Mode for Web' while the extension is published as 'Dark Mode - Dark Reader for Chrome' — a brand mismatch that strongly indicates this is a repackaged or cloned copy of… | |
| 106 | Other | medium | manifest.json (line 19) | Content script is injected at document_start into <all_urls>, all frames, and about:blank, but explicitly excludes darktheme.org — the same domain the new-tab search redirects to. Excluding the publisher's own domain … | |
| 107 | Other | medium | manifest.json (line 13) | Bundles jQuery 3.2.1 (released 2017, affected by CVE-2019-11358 prototype pollution and other XSS sinks) in a background page that holds `<all_urls>` host permission, `tabs`, and `webNavigation`. jQuery is not meaning… | |
| 108 | Privilege Escalation | medium | manifest.json (line 33) | The manifest exposes every file in the extension (`resources: ["*"]`) to every website (`matches: ["*://*/*"]`). This lets arbitrary web pages enumerate and load internal extension resources, enabling fingerprinting o… | |
| 109 | Privilege Escalation | medium | manifest.json (line 16) | The content script injects into every URL (`<all_urls>`), every frame (`all_frames: true`), including about:blank frames, at `document_start`. This is the most aggressive injection profile available and gives the exte… | |
| 110 | Privilege Escalation | medium | manifest.json (line 33) | Every file inside the extension is exposed as a web-accessible resource to every origin (`resources: ["*"]` / `matches: ["*://*/*"]`). This allows arbitrary websites to probe for and load extension assets, reliably fi… | |
| 111 | Privilege Escalation | medium | manifest.json (line 16) | The content script is injected into every URL, every frame (including about:blank sub-frames) at document_start. Combined with the server-controlled update channel in bg.js and the overly broad web_accessible_resource… | |
| 112 | Remote Code Loading | medium | js/bg.js (line 1) | The background script dynamically creates a `<script>` element and appends it to the background page DOM with a 300ms delay, rather than declaring `common.js` statically in the manifest. While the `src` points to a lo… | |
| 113 | Remote Code Loading | medium | content_change/inject.js (line 1) | The content script registers a listener on `chrome.storage.onChanged` that syncs all storage key changes and immediately re-runs `update()`, which re-reads configuration and re-applies behavior on the current page. Th… | |
| 114 | Tracking | medium | manifest.json (line 33) | Every file in the extension package is exposed as a web-accessible resource to every origin. This enables extension fingerprinting by any website and lets remote pages load any packaged asset (including the Cyrillic-n… | |
| 115 | Tracking | medium | scripts/bg.js (line 1) | The extension phones home to darktheme.org on every install and update with the install reason (`install`/`update`) and exact version string. There is no consent flow, no analytics opt-out, and the privacy policy in o… | |
| 116 | Tracking | medium | scripts/bg.js (line 1) | The extension listens to all history state updates (single-page app navigation events) and forwards the full URL of every navigation to the active tab's content script. This gives the extension comprehensive visibilit… | |
| 117 | Tracking | medium | scripts/content/inject.js (line 1) | The extension maintains a hardcoded list of high-value domains — including Gmail, Google Inbox, Google Drive, Facebook, Instagram, Twitter, YouTube, Amazon, Dropbox — and applies domain-specific CSS overrides to each.… | |
| 118 | Tracking | medium | scripts/content/inject.js (line 1) | The content script captures the full URL of every page it is injected into via document.location.href and updates it on every navigation event via a URLChanged message from the background script. This means the backgr… | |
| 119 | Tracking | medium | scripts/bg.js (line 1) | The background service worker listens to every history state update (SPA navigation) and broadcasts the full URL of the current active tab to all content scripts. This creates a comprehensive browsing URL tracking mec… | |
| 120 | Tracking | medium | scripts/bg.js (line 1) | The extension listens to all history state changes (SPA navigations) across all URLs via webNavigation.onHistoryStateUpdated with no URL filtering, then forwards every new URL to content scripts via chrome.tabs.sendMe… | |
| 121 | Tracking | medium | scripts/bg.js (line 28) | The extension registers an uninstall URL containing a base64-encoded payload with extension ID, version, timestamp, and a persistent UID. This is a classic telemetry pattern used to track uninstall events and correlat… | |
| 122 | Tracking | medium | js/bg.js (line 173) | The background page subscribes to webNavigation.onHistoryStateUpdated for all top-frame navigations and forwards every URL to the content script. Combined with the document_start content script on <all_urls>, this giv… | |
| 123 | Tracking | medium | js/bg.js (line 152) | The extension generates a unique user ID and exfiltrates it along with extension metadata to a remote server. This enables persistent tracking of the user's browser activity and extension usage. | |
| 124 | Tracking | medium | newTab/js/newtab_index.js (line 1) | Combined with the chrome_url_overrides newtab entry in manifest.json, the extension replaces Chrome's new-tab page with a custom surface that hosts the search-hijack form and Bing-suggestion exfiltration logic. The to… | |
| 125 | Tracking | medium | js/bg.js (line 127) | Listens to `webNavigation.onHistoryStateUpdated` across all sites and receives every URL change (including SPA pushState events) in the background. Combined with `<all_urls>` and content scripts at `document_start` in… | |
| 126 | Tracking | medium | manifest.json (line 19) | The extension explicitly excludes the operator's own domain https://darktheme.org/* from content-script injection while still matching <all_urls>. That carve-out is characteristic of an operator who treats their own s… | |
| 127 | Tracking | medium | js/background.js (line 488) | On install the extension opens a page on the same C2 domain (darkyou.tube) used for the remote-config beacon, tying fresh installs to the attacker infrastructure. The companion message handler also exposes every frame… | |
| 128 | Unauthorized Data Collection | medium | сomponents/options.html (line 135) | The embedded privacy policy contains a direct internal contradiction: Section 5 admits to using cookies to 'collect, store, and track information for statistical purposes', while Section 7 flatly denies using any anal… | |
| 129 | Unauthorized Data Collection | medium | scripts/bg.js (line 1) | The background script exposes a message handler that returns the full URL of the sender's tab to any caller sending `{message: 'top'}`. Since the extension's content scripts run on all URLs (`<all_urls>`), any web pag… | |
| 130 | Unauthorized Data Collection | medium | content_change/inject.js (line 1) | This method calls `querySelectorAll('*')` on the entire page and reads the computed style of every single DOM element, including input fields, forms, and password fields. On sensitive pages like Gmail or banking sites… | |
| 131 | Phishing | low | сomponents/options.html (line 175) | The only contact/owner identifier in the bundle is an anonymous @darktheme.xyz mailbox on a low-reputation .xyz domain, with no corporate entity, address, or verifiable identity — inconsistent with an 8M-user extensio… | |
| 132 | Unauthorized Data Collection | low | scripts/bg.js (line 1) | The background script responds to a 'top' message from any sender by returning the sender tab's full URL back to the requesting content script. This creates a mechanism for content scripts to query the current tab URL… | |
| 133 | Unauthorized Data Collection | low | сomponents/options.html (line 135) | The in-extension privacy policy contains a 'cookies' section that describes server-side cookie collection for 'statistical purposes', while earlier sections claim the extension collects no personal data and uses no an… | |
| 134 | Unauthorized Data Collection | low | content_change/inject.js (line 1) | A `MutationObserver` is attached to the entire document with `subtree: true` starting at `document_start`, monitoring all DOM mutations across every page the user visits. While declared for stylesheet persistence, thi… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
40
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| www.w3.org | /Graphics/SVG/1.1/DTD/svg11.dtd | http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd |
| github.com | /tovic | https://github.com/tovic |
| clients2.google.com | /service/update2/crx | https://clients2.google.com/service/update2/crx |
| www.statisticssolutions.com | /what-is-logistic-regression/*/ | https://www.statisticssolutions.com/what-is-logistic-regression/*/ |
| www.ucat.ac.uk | /ucat/universities/*/ | https://www.ucat.ac.uk/ucat/universities/*/ |
| www.sltrib.com | /*/ | https://www.sltrib.com/*/ |
| userstyles.org | /styles/31267/global-dark-style-changes-everything-to-dark | https://userstyles.org/styles/31267/global-dark-style-changes-everything-to-dark |
| userstyles.org | /styles/23516/midnight-surfing-global-dark-style | https://userstyles.org/styles/23516/midnight-surfing-global-dark-style |
| userstyles.org | /styles/131303/global-black-theme | https://userstyles.org/styles/131303/global-black-theme |
| userstyles.org | /styles/104936/global-style-pitch-black | https://userstyles.org/styles/104936/global-style-pitch-black |
Showing 1 to 10 of 40 rows
Rows per page:
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.