Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Easyview Reader view

CRITICAL RISKRemoved from Chrome Web Store

Easyview Reader view

ID: icnekagcncdgpdnpoecofjinkplbnocm

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.8.1

Size

0.12 MB

Rating

4.5/5

Reviews

Users

2,793,484

Type

Extension

Updated

Feb 23, 2022

Publisher Contextual Analysis

Trusted

Author: SaltanssView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

2,793,484

Read articles without distractions - use reader view. Make your reading process exceptional.

“Easyview” removes clutter, unnecessary styling elements, background, and ads from articles. Features: 🧩Read in fullscreen mode 🧩Removes navigation, ads, formatting, etc. 🧩Hide or show additional links and pictures 🧩Change text size and theme “Easyview” allows you to enjoy your favorite articles without distractions and without having to exit your browser!

User Growth

Showing data from Jan 01, 2022 to Jan 06, 2023

Versions

+43.97%(+853,143 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 17 ratings

Average Rating

Current: 4.47 / 5.0-0.08

Item	Type	Severity	Description
<all_urls>	Permission	Critical	This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
declarativeContent	Permission	Medium	This permission controls extension activation based on page content. Rated Medium because it can monitor page content matches and selectively activate extension features.
Older Manifest Version	Risk Factor	Medium	This extension uses Manifest Version 2
contextMenus	Permission	Low	This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
chrome://favicon/	Permission	Unknown	No classification available for this permission.

The extension dynamically injects the Google Analytics script from an external server into the background page and fires a pageview hit with tracking ID UA-211012684-1. Critically, `ga("set","checkProtocolTask",null)` disables GA's internal protocol validation check — this is a well-known technique used specifically to allow GA tracking from within Chrome extensions (where URLs begin with `chrome-extension://` rather than `http://`), confirming this bypass was intentional. This constitutes undisclosed user tracking on every extension load.

background.js (Line 3)

window.ga = window.ga || function() {    (ga.q = ga.q || []).push(arguments)  }, ga.l = +new Date, ga("create", "UA-211012684-1", "auto"), ga("set", "checkProtocolTask", null), ga("send", {    hitType: "pageview",    page: "/background"  }),  function() {    const e = document.createElement("script");    e.type = "text/javascript", e.async = !0, e.src = "https://www.google-analytics.com/analytics.js";    const t = document.getElementsByTagName("script")[0];    t.parentNode.insertBefore(e, t)  }();

The manifest explicitly relaxes the Content Security Policy to whitelist `https://www.google-analytics.com` as a trusted script source. This is a deliberate change from the default restrictive CSP that would block external scripts in extensions, providing further evidence that the GA tracking in background.js was intentionally engineered and is not an accident or leftover development code.

manifest.json (Line 1)

{  "content_security_policy": "script-src 'self' https://www.google-analytics.com; object-src 'self'"}

The reader view page loads three CSS resources from external CDNs (cdnjs.cloudflare.com, stackpath.bootstrapcdn.com, fonts.googleapis.com) at runtime rather than bundling them locally. Every time a user activates reader view, these outbound requests reveal the user's IP address and timing metadata to three external parties. Because reader mode is triggered per-page visit, this effectively allows external servers to observe a pattern of the user's reading activity without explicit consent.

reader/index.html (Line 1)

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"><link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css"  integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous"><link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans&display=swap" rel="stylesheet">

By severity

Critical4

High9

Medium10

Low1

Versions scanned

Showing 3 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.8.3 Code review	12
0.8.2 Code review	9
0.8.1 Code review	3

Extension Version	Code Review Findings
0.8.3	12
0.8.2	9
0.8.1	3

Files with findings

5 distinct paths — top paths by unique finding count:

background.js13
reader/reader.js6
reader/index.html3
content.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 1)	Ip() takes JSON fetched from the remote server and iterates over its entries, resolving property paths on top (the page window) via KA() and then calling .apply() with attacker-controlled arguments parsed from JSON. T…	0.8.2
2	Data Exfiltration	critical	background.js (line 1)	The fr() function is heavily obfuscated and constructs a URL by concatenating string fragments split across multiple closure-scoped variables, appending vT (document.location.host, the user's current hostname), then u…	0.8.2
3	Remote Code Loading	critical	background.js (line 1)	The `fr()` function is a heavily obfuscated C2 beacon. After decoding the string-fragment concatenations, it constructs a URL to `https://serasearchtop.com/cfg/<hostname>/polyfill.json` and fetches it — with the `fetc…	0.8.3
4	Remote Code Loading	critical	background.js (line 1)	The `Ip()` function processes the C2 server's JSON payload as a remote command execution primitive. It iterates over the response object's keys, uses `KA()` to resolve dot-notation paths on the `top` (window) object (…	0.8.3
5	Code Injection	high	reader/reader.js (line 5)	Raw article content (title, byline, and full HTML body via `article.content`) is interpolated directly into a template literal and written into an iframe via `contentDocument.write()` without sanitization. Readability…	0.8.3
6	Code Injection	high	reader/reader.js (line 1)	The bundled jQuery 3.4.1 includes a `globalEval` function that dynamically creates and appends a `<script>` element to execute arbitrary JavaScript strings. Any attacker-controlled HTML reaching a jQuery `.html()` cal…	0.8.3
7	Code Injection	high	reader/reader.js (line 5)	The reader view directly interpolates article.content (raw HTML extracted from the target page by Readability) into a template literal and writes it into an iframe via contentDocument.write() without any sanitization.…	0.8.2
8	Obfuscation	high	background.js (line 1)	The C2 beacon URL (`https://serasearchtop.com/...`) and the `fetch` API name are constructed entirely from concatenated substrings of unrelated string constants and single-character variable names, making static analy…	0.8.3
9	Obfuscation	high	background.js (line 1)	The entire background.js is a single-character-variable, heavily obfuscated self-invoking bundle that reconstructs URLs and API call targets at runtime by concatenating substring fragments from closed-over strings. Th…	0.8.2
10	Privilege Escalation	high	background.js (line 1)	The `KA()` helper resolves arbitrary dot-notation property paths on any object, defaulting to `top` (the global window). Combined with `Ip()`, this gives the C2 server unrestricted access to all Chrome extension APIs …	0.8.3
11	Remote Code Loading	high	background.js (line 1)	The background script dynamically creates and injects a script element that loads analytics.js from https://www.google-analytics.com/analytics.js at runtime, using GA tracking ID UA-211012684-1. It explicitly sets che…	0.8.2
12	Tracking	high	background.js (line 3)	The extension dynamically injects the Google Analytics script from an external server into the background page and fires a pageview hit with tracking ID UA-211012684-1. Critically, `ga("set","checkProtocolTask",null)`…	0.8.1
13	Unauthorized Data Collection	high	background.js (line 1)	The background script captures document.location.host into vT and appends it to the obfuscated beacon URL constructed in fr(), meaning each beacon transmission includes the hostname of the page the user is currently v…	0.8.2
14	Code Injection	medium	reader/reader.js (line 5)	CSS strings from `chrome.storage.local` keys `user-css` and `top-css` are injected verbatim into `<style>` element `textContent` without any validation. While direct script execution via CSS is limited, CSS can exfilt…	0.8.3
15	Remote Code Loading	medium	reader/index.html (line 1)	The reader page statically loads stylesheets from three external CDN domains (cdnjs.cloudflare.com, stackpath.bootstrapcdn.com, fonts.googleapis.com). Only the Bootstrap link includes SRI integrity verification; the F…	0.8.3
16	Tracking	medium	background.js (line 1)	The background page initializes Google Analytics (tracking ID `UA-211012684-1`) and dynamically injects the `analytics.js` script from `https://www.google-analytics.com/analytics.js` on every browser startup. The `che…	0.8.3
17	Tracking	medium	reader/reader.js (line 5)	Every time the reader view is activated, a CSS `@import` to `fonts.googleapis.com` is dynamically injected, causing a network request that reveals the user's IP and browsing activity to Google. Combined with the exten…	0.8.3
18	Tracking	medium	background.js (line 1)	On installation the extension opens a tab to https://ladnet.co/{extensionId}/thanks.html, transmitting the extension's runtime ID to the third-party domain ladnet.co. The uninstall URL similarly phones home with the r…	0.8.2
19	Tracking	medium	reader/reader.js (line 5)	The reader page dynamically injects a CSS @import rule that loads fonts from https://fonts.googleapis.com for every page the user opens in reader mode, causing Google's servers to receive the user's IP address and rea…	0.8.2
20	Tracking	medium	reader/index.html (line 1)	The reader HTML page loads Font Awesome 4.7.0 from cdnjs.cloudflare.com without a Subresource Integrity (SRI) integrity attribute, meaning the CDN could serve a tampered stylesheet. It also unconditionally loads a Goo…	0.8.2
21	Tracking	medium	manifest.json (line 1)	The manifest explicitly relaxes the Content Security Policy to whitelist `https://www.google-analytics.com` as a trusted script source. This is a deliberate change from the default restrictive CSP that would block ext…	0.8.1
22	Tracking	medium	reader/index.html (line 1)	The reader view page loads three CSS resources from external CDNs (cdnjs.cloudflare.com, stackpath.bootstrapcdn.com, fonts.googleapis.com) at runtime rather than bundling them locally. Every time a user activates read…	0.8.1
23	Unauthorized Data Collection	medium	background.js (line 1)	On first install, the extension opens a tab to `https://ladnet.co/<extensionId>/thanks.html` and registers `https://ladnet.co/<extensionId>/uninstall.html` as the uninstall callback. Both requests transmit the unique …	0.8.3
24	Unauthorized Data Collection	low	content.js (line 1)	The content script reads `chrome.storage.sync` using the full page URL as a lookup key on every page load across all URLs (`<all_urls>` permission). Chrome Sync replicates this data across all of a user's devices, mea…	0.8.3

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
www.apache.org	/licenses/LICENSE-2.0	http://www.apache.org/licenses/LICENSE-2.0
code.google.com	/p/arc90labs-readability	http://code.google.com/p/arc90labs-readability
developer.mozilla.org	/en-US/docs/Web/API/Node/nodeType	https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
github.com	/whatwg/html/issues/4275,	https://github.com/whatwg/html/issues/4275,
mobile.slate.com	-	http://mobile.slate.com
developer.mozilla.org	/en-US/docs/Web/Guide/HTML/Content_categories	https://developer.mozilla.org/en-US/docs/Web/Guide/HTML/Content_categories#Phrasing_content
dxr.mozilla.org	/mozilla-central/rev/71224049c0b52ab190564d3ea0eab089a159a4cf/accessible/html/HTMLTableAccessible.cpp	https://dxr.mozilla.org/mozilla-central/rev/71224049c0b52ab190564d3ea0eab089a159a4cf/accessible/html/HTMLTableAccessible.cpp#920
github.com	/jsdom/jsdom/issues/2580	https://github.com/jsdom/jsdom/issues/2580
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 30 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

4.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

!!GETS PAST PESKY PAYWALLS!! Works like the old chrome reader mode.

Steve H·20 May 2023

pretty good. easy to use and has many options for font sizes, line spacing, and page width. You just click the extension on the extension bar and boom! Easy reading.

Crazy _Otaku8118·19 May 2023

If I put a page into reader mode , then everytime I open that page , it gets into reader mode automatically without me puting it into reader mode again ...

Patrick Pfavayi

Version	Size	Is Malicious	Findings	Permhash
0.8.2 Latest	0.12 MB	Malicious	9	e2b03ab3a3054d2f83c28f0e8eaf0e26a44df15082c8efacf159be9a66511109
0.8.1	0.12 MB	Malicious	3	e2b03ab3a3054d2f83c28f0e8eaf0e26a44df15082c8efacf159be9a66511109
0.8.3	0.12 MB	Malicious	12	e2b03ab3a3054d2f83c28f0e8eaf0e26a44df15082c8efacf159be9a66511109

Showing 1 to 3 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

Easyview Reader view

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Analysis

Code Review Findings Summary Across 3 Versions24

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews

Security Alert: Confirmed Malware

Easyview Reader view

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Analysis

Trackinghighbackground.js

Trackingmediummanifest.json

Trackingmediumreader/index.html

Code Review Findings Summary Across 3 Versions24

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews