Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Flash Player

CRITICAL RISKRemoved from Chrome Web Store

Flash Player

ID: bmimdmkleccdoghpgdhaahkelfhjfhgm

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.6.5

Size

0.08 MB

Rating

3.5/5

Reviews

709

Users

1,118,276

Type

Extension

Updated

Oct 6, 2020

Publisher Contextual Analysis

Author: Good App DeveloperView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,118,276

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Flash Player saves your favourite flashes to playlist and run them later.

Play Flash files anywhere across the WEB! Flash player is a well design Chrome Extension, which allows you to add any flash (swf) file into the app's playlist and access them by simply clicking FLash Player icon. Simply navigate to the webpage, which hosts flash file, you want to play, open the FLash player Extension, choose from detected flash files and click the Add button. Voila! Flash file is saved and hosted in your playlist now, you can play it whenever you want! All flash games, videos and other files, added into Flash Player playlist are saved without quality loss, enjoy the original image and sound quality from the upper right corner of your Chrome Browser:) To add Flash player to the browser, click "Add to Chrome" button from the right corner of this pop up window. To remove Flash Player Extension from Chrome browser, right-click on extension icon and choose "Remove from Chrome" option. Flash Player is a trademark owned by Adobe Systems. Flash Player extension doesn't ads Adobe Flash Player functionality to your browser, it Plays flash files only, as stated in extension name and description.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High8

Medium2

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6.5 Code review	9
1.6.4 Code review	4

Extension Version	Code Review Findings
1.6.5	9
1.6.4	4

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js8
js/content.js3
js/iframe-access.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/content.js (line 1)	When the user plays a Flash file on any HTTPS page, the embed src is silently rewritten from the original URL to https://greatapptst.com/redirect.php?url=<original_url>, routing every Flash request through an unknown …	1.6.4
2	Network Interception	critical	js/background.js (line 219)	This monitors every successful top-level navigation, derives the visited domain, and queries a remote affiliate template to decide whether to trigger further requests or redirects. That is a classic traffic hijacking …	1.6.5
3	Network Interception	critical	js/background.js (line 1)	The extension registers a blocking webRequest listener on all URLs for main_frame and sub_frame requests, and inside handleIncomingHeaders it calls filterHeadersFromCsp which silently strips Content-Security-Policy, F…	1.6.4
4	Code Injection	high	js/background.js (line 318)	The helper explicitly strips `Content-Security-Policy`, `Frame-Options`, and `X-Frame-Options` from responses. Removing these headers weakens page isolation and framing protections, which can enable injected embeds or…	1.6.5
5	Code Injection	high	js/content.js (line 1)	The injected embed element is created with allowscriptaccess="always", which permits the Flash content (sourced from the attacker-controlled redirect server) to execute arbitrary JavaScript in the context of the curre…	1.6.4
6	Data Exfiltration	high	js/background.js (line 455)	The extension exfiltrates the full redirect chain it observed to a configurable remote endpoint. Those chains contain the user's browsing destinations and any intermediate tracking URLs, which is sensitive browsing-hi…	1.6.5
7	Network Interception	high	js/background.js (line 70)	This creates a blocking `webRequest` hook across all URLs and removes any response headers listed in remotely supplied `ignoreFields`. A remote operator can use this to suppress security-relevant headers or alter site…	1.6.5
8	Network Interception	high	js/background.js (line 305)	The extension rewrites the outgoing `Referer` header using remote matching rules and values derived from prior responses. Forging referrers is commonly used to fake attribution, bypass anti-abuse checks, or make redir…	1.6.5
9	Remote Code Loading	high	js/iframe-access.js (line 74)	The content script loads third-party JavaScript from Mixpanel's CDN into every page and initializes analytics from remotely supplied config. Loading remote code inside a content script is a serious integrity risk beca…	1.6.5
10	Unauthorized Data Collection	high	js/background.js (line 17)	The extension phones home to `flplay.net` with a persistent UUID plus install/runtime telemetry (`uid`, version, and timestamps). The server response is merged directly into runtime config and immediately activates ot…	1.6.5
11	Unauthorized Data Collection	high	js/iframe-access.js (line 1)	This script runs inside every iframe on every page (manifest sets all_frames: true) and polls every second via setInterval to harvest Flash object URLs from the DOM, then sends them to the background script via chrome…	1.6.4
12	Network Interception	medium	js/content.js (line 95)	When the current page is HTTPS, the extension does not load the Flash resource directly and instead routes it through `greatapptst.com/redirect.php`. That inserts a remote intermediary into user content loads, creatin…	1.6.5
13	Unauthorized Data Collection	medium	js/background.js (line 189)	This probes whether other extensions are installed by opening `chrome-extension://<id>/manifest.json` and inferring success from `insertCSS` errors. Enumerating the user's extension environment is a fingerprinting/pri…	1.6.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It worked easilty. I just added this extension to chrome and the flash based application started working but no idea if it is thrustworthy (security, privacy breech etc), however.

suren patwardhan·11 Oct 2020

Funcionando al 100. Cuando la instalas debes proporcionar los permisos en seguridad y privacidad para que entre flash y en bloqueos permitir en la páginas

Berna·8 Oct 2020

СОВСЕМ НЕ РАБОТАЕТ, ПОЖАЛУЙСТА ИСПРАВТЕ ОШИБКУ !!!!

ГЗ

Галина Золотухина

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Flash Player

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews