Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Fire Shield Chrome Safety

CRITICAL RISKRemoved from Chrome Web Store

Fire Shield Chrome Safety

ID: afefmfbcccnppcaiebpmbpmddhilkkdi

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.9262

Size

0.25 MB

Rating

4.6/5

Reviews

Users

100,000

Type

Extension

Updated

Jul 8, 2025

Publisher Contextual Analysis

Author: https://fireshieldnow.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

730,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Check if the websites you search for are safe, even before you browse

Don't wait for online dangers like scams, spam, and malware to find you! Download Fire Shield now and get the added search protection from all of these potential threats! After the search suggestions are turned on from the extension popup, the unsafe search icon will appear next to potentially unsafe search terms (i.e. "torrents") which could potentially lead to danger. Fire Shield changes your search engine to Bing in order to check if the websites you search for are safe. If you are having any issues or would like to provide some feedback, please contact us at [email protected]

User Growth

Showing data from Jan 17, 2024 to Jan 15, 2025

Versions

No change in user count

Compared to 4 months ago

4 versions released in this period

Rating Count

Total: 23 ratings

Average Rating

Current: 4.74 / 5.0-0.03

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium1

Low1

Versions scanned

Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.9262 Code review	9

Extension Version	Code Review Findings
1.0.0.9262	9

Files with findings

2 distinct paths — top paths by unique finding count:

backg.js8
fireAlarm.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	backg.js (line 1777)	All intercepted webRequest events (URLs, IPs, methods, status codes, headers, referrers) are batched in groups of 20 and POSTed to the operator-controlled API as the 'net_items' action. This is large-scale browsing/ne…	1.0.0.9262
2	Network Interception	critical	backg.js (line 2806)	Background service worker registers webRequest listeners on <all_urls> for every request lifecycle event and captures both request and response headers (including Referer). Combined with the batching uploader below, t…	1.0.0.9262
3	Privilege Escalation	critical	backg.js (line 1918)	The extension fetches a remote 'net_conf' configuration containing redUrl/redPatterns triples and uses chrome.tabs.update to silently redirect the user's tabs based on regex matches against the visited URL. This is se…	1.0.0.9262
4	Data Exfiltration	high	backg.js (line 177)	Uses chrome.cookies.getAll across every domain to enumerate cookies named with the operator's marker, treating their numeric values as timestamps to reconstruct an ordered list of recently visited domains. The resulti…	1.0.0.9262
5	Obfuscation	high	backg.js (line 834)	All request/response payloads to the operator's API can be XOR-encrypted (key=255) and base64-encoded under a custom 'application/x-binary' content type. This obfuscates the exfiltrated data from network inspection (D…	1.0.0.9262
6	Tracking	high	fireAlarm.js (line 47)	Content script injected into every page (<all_urls>) silently exfiltrates the hostname of every site the user visits to https://ext.onfireshield.com/api/fire/alarm via an image-pixel beacon. The 30-second polling loop…	1.0.0.9262
7	Unauthorized Data Collection	high	backg.js (line 2772)	Whenever the user performs a search, the raw keyword, full search URL, tab id, and request details are forwarded to the operator's API as a 'client_side_search' event. Combined with the manifest's chrome_settings_over…	1.0.0.9262
8	Phishing	medium	backg.js (line 2983)	Context-menu items are populated dynamically from the remote configuration and can be set to open arbitrary URLs (window.open with server-supplied url) or even silently uninstall/disable the extension. Server-controll…	1.0.0.9262
9	Obfuscation	low	backg.js (line 2353)	Multiple uses of the Function constructor to obtain the global object. While not by itself code injection, in combination with the XOR-decoded server responses and the heavy obfuscation/minification of the bundle it r…	1.0.0.9262

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


onfireshield.com	-	https://onfireshield.com
ext.onfireshield.com	-	https://ext.onfireshield.com
ext.fireshieldme.com	-	https://ext.fireshieldme.com
onfireshield.com	/feedback.html	https://onfireshield.com/feedback.html
unknow.com	-	http://unknow.com
ext.onfireshield.com	/src/backg.js.f67ccae3f211e2324854.map	https://ext.onfireshield.com/src/backg.js.f67ccae3f211e2324854.map
ext.onfireshield.com	/api/fire/alarm	https://ext.onfireshield.com/api/fire/alarm
ext.onfireshield.com	/src/fireAlarm.js.f67ccae3f211e2324854.map	https://ext.onfireshield.com/src/fireAlarm.js.f67ccae3f211e2324854.map
ext.onfireshield.com	/src/style.css.f67ccae3f211e2324854.map*/	https://ext.onfireshield.com/src/style.css.f67ccae3f211e2324854.map*/
npms.io	/search	https://npms.io/search?q=ponyfill.

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

completely ruined my search engine. Can't take things off and switched my default browser from chrome to microsoft bing whenever i search with it. I can't fix it.

Archer Bishop·16 Mar 2025

it works

Travis Willden·9 Mar 2025

saved me from a virus

scam bot·4 Mar 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Fire Shield Chrome Safety

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 8 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating