Chrome Web StoreCaution required
Suspicious in code review (v1.0.2)
Our reviewer found behaviour consistent with malware in version 1.0.2, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
13 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
DAT GO is rated caution by Extension Auditor. Our code review reported 4 findings (1 critical, 3 high), led by network interception. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.
Key findings
- Critical
Network Interception
A system-wide HTTP proxy (scope: 'regular') is applied using configuration fetched from [domain withheld] — a third-party server unrelated to [domain withheld] and not disclosed as the publisher's own domain. The bypass list only excludes Google domains, localhost, and [domain withheld] itself, so ALL other browser traffic (banking, email, any non-Google site) is routed through the operator-controlled proxy. This enables comprehensive HTTP traffic interception and, in environments where the proxy injects a CA certificate, full HTTPS MitM — capabilities entirely unjustified for a DAT session manager.
- High
Other
The bundled manifest includes proxy, webRequest, webRequestAuthProvider, declarativeNetRequest, and <all_urls> — none of which appear in the CWS-published manifest, which only lists cookies, storage, tabs, activeTab, scripting, webNavigation, and management. The published manifest also lacks the broad <all_urls> host permission and the Google-domain host permissions present in the bundle. Hiding the exact permissions that enable the system-wide proxy and full-URL network interception from the store listing is a strong indicator of deliberate concealment to bypass the additional user-consent warnings those permissions trigger.
- High
Remote Code Loading
HTML fetched from the backend server ([domain withheld] or fallbacks) is injected directly into the extension popup DOM via innerHTML with no sanitization. Although MV3 CSP blocks inline script execution, the backend can inject arbitrary anchor tags with attacker-controlled hrefs, phishing forms, or event-handler-bearing elements that appear within the trusted extension popup UI. This is an active remote markup loading channel: every time the popup opens, the operator can silently change the UI to redirect users to phishing pages or exfiltrate data via form submissions.
- High
Credential Theft
The operator backend ([domain withheld]) is the authoritative store for all [domain withheld] session credentials: it downloads cookie payloads, the extension first wipes all existing [domain withheld] cookies via clearBrowserData() which calls chrome.cookies.getAll({}) without a domain filter, then injects the operator-supplied set. The operator therefore holds, rotates, and fully controls every user's [domain withheld] authentication state. If the backend is compromised or operated maliciously, it can inject session tokens pointing to any [domain withheld] account, silently replacing legitimate user sessions with operator-chosen ones.
Analyst notes
The extension routes ALL non-Google browser traffic through a third-party HTTP proxy configured from [domain withheld] (:57-72) — far beyond what DAT session management requires and enabling comprehensive traffic interception for any site the user visits. Critically, the bundled manifest declares proxy, webRequest, webRequestAuthProvider, declarativeNetRequest, and <all_urls> permissions that are entirely absent from the CWS-published manifest, indicating deliberate concealment of dangerous capabilities during store review. The ML score of 0.16 underweights these behaviors; the permhash cluster's 40% malware overlap and the IoC flag from store monitoring corroborate the verdict rather than contradict it.
DAT GO Chrome extension security report
ID: fjpobenajidogfpilgbjgbglcanfjnoa
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- RTN Global
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 1209 Mountain Rd Pl NE ste r Albuquerque, NM 87110-7845 US
- Website
- Visit
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- *://script.google.com/*
- *://script.googleusercontent.com/*
- *://*.google.com/*
13 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
DAT GO browser extension for managing DAT sessions
Read the publisher’s full description
DAT GO is a browser extension designed for organizations that need streamlined access to DAT platform services. The extension supports secure session management and provides authorized users with controlled access to DAT resources through an intuitive interface. Key Features: Secure DAT Session Management Access and manage DAT platform sessions with built-in authentication and session persistence. Multi-Browser Compatibility Works seamlessly across Chrome and Firefox browsers with consistent functionality. Cookie and Storage Management Efficiently handle browser cookies and local storage for optimal DAT platform performance. Real-Time Session Monitoring Monitor active DAT sessions and receive status updates directly in the browser. Administrative Controls Organization administrators can configure and manage extension settings and permissions. Privacy: All session operations occur locally within the user's browser with encrypted storage. No browsing history, personal data, or analytics are collected or transmitted. The extension operates independently without external data sharing or third-party tracking, ensuring complete privacy for organizational use.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
13 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from RTN Global
- DAT Ex Pro45 users
- Swift Solutions33 users
- Instant Annotator31 users
- Swift Solutions25 users
- SwiftSolutions7 users
Popular in Developer Tools
- GoFullPage - Full Page Screen Capture11,000,000 users
- touchenex 확장8,000,000 users
- SentinelOne7,000,000 users
- TrendAI™ Toolbar for Enterprise7,000,000 users
- React Developer Tools5,000,000 users