Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Earth View 3D Maps

CRITICAL RISKRemoved from Chrome Web Store

Earth View 3D Maps

ID: nhcddaofeiiblgpocngbnbggdopaliba

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.12001.8

Size

0.35 MB

Rating

1.0/5

Reviews

Users

10,000

Type

Extension

Updated

Apr 29, 2026

Publisher Contextual Analysis

Trusted

Author: https://www.earthview3dmaps.com/View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Earth View 3D Maps

Discover the easiest way to explore the world with EarthView3DMaps! Whether you're planning scenic road trips, cycling adventures, or leisurely city strolls, EarthView3DMaps makes it simple to plan and navigate your journey. With user-friendly controls, you can zoom in to uncover every detail along your route! Set your starting point, choose your destination and mode of transport, and let EarthView3DMaps handle the rest. Features: - Find the best fuel prices - Experience 3D and Satellite views - Check current traffic conditions - Sidestep traffic slowdowns - Print directions for convenience Experience every journey with precision, convenience, and joy!

User Growth

Showing data from Jan 22, 2025 to May 17, 2026

Versions

+100%(+5,000 users)

Compared to Feb 28, 2025

2 versions released in this period

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High3

Medium1

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.12001.8 Code review	9

Extension Version	Code Review Findings
3.12001.8	9

Files with findings

2 distinct paths — top paths by unique finding count:

page.js8
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	page.js (line 13838)	Event data (event type and messages) is POSTed to a URL dynamically sourced from server-controlled configuration at `this.data.derive.pocket`. The destination endpoint is not hardcoded but fetched from the remote serv…	3.12001.8
2	Remote Code Loading	critical	page.js (line 11637)	The extension dynamically injects an iframe from 'https://gadget.earthview3dmaps.com/app/travel/public/index.html' into every webpage visited, hidden inside a shadow DOM container. The iframe is sandboxed with allow-s…	3.12001.8
3	Tracking	critical	page.js (line 1191)	The content script reads a persistent user identifier ('uid') from chrome.storage.sync and listens for postMessage requests on every page. When an injected iframe (from the extension's remote server) sends a matching …	3.12001.8
4	Unauthorized Data Collection	critical	manifest.json (line 21)	The extension declares a 736KB obfuscated content script (page.js) that runs at document_start on every HTTP and HTTPS page the user visits. Despite claiming to be a '3D Maps' extension that only needs storage and ala…	3.12001.8
5	Unauthorized Data Collection	critical	page.js (line 17350)	On every webpage, the content script immediately captures and publishes the current page title, window name, and full URL. It also attaches a Navigation API listener that fires on every URL change (SPA navigation, bac…	3.12001.8
6	Obfuscation	high	page.js (line 1)	The entire 736KB page.js is heavily obfuscated: variable names are meaningless composites (e.g., 'uint8_Direction_Encode', 'b_Extract_Ink', 'iterable_End_Export'), and the code is filled with dead computations — array…	3.12001.8
7	Tracking	high	page.js (line 15519)	The extension fires tracking beacons (POST requests) to remote URLs (trackUrl, impUrl) received from the server-controlled configuration on every SHOW, IMPRESSION, and CLICK event of injected overlay content. This is …	3.12001.8
8	Tracking	high	page.js (line 9637)	Two tracking pixel mechanisms are implemented: one via fetch with mode:'no-cors' (invisible to the user, bypasses CORS restrictions) and one via a zero-size Image element whose src is set to an arbitrary remote URL. T…	3.12001.8
9	Data Exfiltration	medium	page.js (line 8733)	The extension uses postMessage with a wildcard origin ('*') to communicate with injected iframes, transmitting event data and messages to the remote frame without origin verification. This means any page that has an i…	3.12001.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.earthview3dmaps.com	/jogger	https://www.earthview3dmaps.com/jogger?proclaim=
www.earthview3dmaps.com	-	https://www.earthview3dmaps.com
gadget.earthview3dmaps.com	/app/travel/public/index.html	https://gadget.earthview3dmaps.com/app/travel/public/index.html
fonts.googleapis.com	-	https://fonts.googleapis.com
fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400&family=Poppins:wght@300&display=swap
www.earthview3dmaps.com	/fissiparous/antipathetic	https://www.earthview3dmaps.com/fissiparous/antipathetic?r=${encodeURIComponent(

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.8 out of 5 · 6 most recent reviews

Text reviews

Positive

Negative

Installed. No where to add address. Uninstalling.

Jay Dee·10 Apr 2025

Just installed and, literally, 30 minutes later I am uninstalling. I don't know what's going on, but all of a sudden this extension is hijacking clickable links and opening up new tabs which ALL go to a Yahoo search engine based on what I was just Googling. Absolute dealbreaker - this is basically a browser hijacker.

The Khamisi Project·28 Mar 2025

I don't see anywhere to enter an address. this thing is useless.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Earth View 3D Maps

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating