Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Flash Player for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Flash Player for Chrome

ID: nddmmcpmdbkooddfjcohmlcfclhllgeh

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.2.4

Size

6.70 MB

Rating

3.4/5

Reviews

288

Users

489,229

Type

Extension

Updated

Mar 27, 2023

Publisher Contextual Analysis

Trusted

Author: Flash AppView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

489,230

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Fastest way to run favorite flash content (SWF) across the web!

Flash Player for Chrome - is an essential component for watching or videos and run multimedia games on the Web. This is totally free extension for you. Flash Player is an excellent player tool. It supports all formats and HD flashes files. Want to play a flash game that you found on favorite gaming website but can't run it due to the "Adobe Flash Player is no longer supported" error? Then this Chrome tool will be useful for you. Our extension detects any flash-content on a web page and then replaces standard flash file playback errors with the "Play" button, which you can click to open the game. How the extension works: 1. Go to a site with flash games. 2. Enable the Flash player itself in the pop-up extension window (red button "Enable Flash Player Emulator") 3. Important: Reload the site page. 4. Click on the Play button. 5. Start playing. Nothing complicated! For convenience, the most popular flash games that you might like have been added to the new version of the extension. Try out flash games now on browser Chrome! Restore your memories with these beautiful games and challenge your friends. Note! Flash Player is a helper tool for Google Chrome users. Flash Player is not officially affiliated with products Adobe Flash Player or any others Adobe products. Flash logo® (“the Flash logo”) are registered trademarks of Adobe Inc. We really hope that our Flash Player will be useful to you! We look forward to your feedback and ratings! Also write your suggestions for improving the functionality.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+21.83%(+87,654 users)

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 270 ratings+4 (2%)

Average Rating

Current: 3.53 / 5.0+1.04

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High7

Medium4

Low0

Versions scanned

Showing 2 of 13 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.2 Code review	5
1.1.10 Code review	8

Extension Version	Code Review Findings
1.2.2	5
1.1.10	8

Files with findings

5 distinct paths — top paths by unique finding count:

js/bg.js4
js/player/player.js3
js/popup.js3
js/player/index.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/player/index.js (line 1)	This message handler accepts fetch requests from any origin (no e.origin check) and fetches arbitrary URLs on behalf of the sandboxed iframe, then posts full response buffers back with a wildcard target origin ("*"). …	1.1.10
2	Remote Code Loading	critical	js/popup.js (line 1)	The popup fetches external HTML from fflashgames.com and uses regex to extract URLs and image paths from the raw response, then passes them to renderGames() which injects them unsanitized into the DOM via jQuery appen…	1.1.10
3	Code Injection	high	js/popup.js (line 1)	Externally-fetched URL strings are interpolated directly into an HTML template and appended to the DOM with no sanitization or escaping. The unquoted href attribute (href=${e.url}) allows an attacker controlling fflas…	1.1.10
4	Code Injection	high	js/bg.js (line 1)	When the user enables the extension, the background service worker opens a new tab to an external URL (provided by the message sender) and immediately injects render_modal.js into it via chrome.scripting.executeScript…	1.1.10
5	Data Exfiltration	high	js/player/index.js (line 68)	The top frame accepts `message` events without validating `origin` or `source`, performs `fetch(t.href)` on the supplied URL, and returns the raw bytes back to the iframe. Combined with the extension's `:///*` host …	1.2.2
6	Network Interception	high	js/player/player.js (line 1)	The sandboxed player overrides window.fetch to route all HTTP requests through top.postMessage with a wildcard target origin ("*"), and installs window.onmessage without validating the response sender's origin. The us…	1.1.10
7	Privilege Escalation	high	js/player/player.js (line 27)	The sandboxed player overrides `window.fetch` so that any requested URL is forwarded to the top frame using `postMessage('*')`. This is suspicious because code running inside the SWF emulator can ask the privileged to…	1.2.2
8	Tracking	high	js/bg.js (line 8)	On install/update events, the extension sends a base64-encoded telemetry payload containing the extension ID, version, event reason, timestamp, and a persistent UID to `flashplay.net`. The server response is then allo…	1.2.2
9	Tracking	high	js/bg.js (line 46)	The extension creates and persists a unique identifier in local storage, then repeatedly posts it with version and timestamp data to a remote configuration endpoint. This establishes long-term user/installation tracki…	1.2.2
10	Obfuscation	medium	js/player/player.js (line 1)	The real window.localStorage is replaced with an in-memory stub, hiding actual storage access from Flash SWF content running in the emulator. This obfuscates what data the SWF reads or writes, making forensic analysis…	1.1.10
11	Privilege Escalation	medium	manifest.json (line 38)	The content script page.js is injected at document_start into every frame on every URL including about:blank frames, before any page content loads. Combined with the scripting permission and :///* host_permissions, …	1.1.10
12	Tracking	medium	js/bg.js (line 28)	The uninstall URL is dynamically set to a remote `flashplay.net` endpoint and includes the persistent UID plus metadata in the query string. That lets the operator track removal events per installation and redirect th…	1.2.2
13	Tracking	medium	js/popup.js (line 1)	Every time a user clicks 'Enable Flash Player emulator', the extension silently opens https://fflashgames.com/ in a new tab and injects render_modal.js into it. This is undisclosed traffic redirection to a third-party…	1.1.10

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Poppins:wght@700&display=swap
cdn.mxpnl.com	/libs/mixpanel-2-latest.min.js	https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
chrome.google.com	/webstore/detail/flash-playlist/nddmmcpmdbkooddfjcohmlcfclhllgeh	https://chrome.google.com/webstore/detail/flash-playlist/nddmmcpmdbkooddfjcohmlcfclhllgeh
fflashgames.com	/list.php	https://fflashgames.com/list.php?c=2
https:	-	https://fflashgames.com${s[e
fflashgames.com	-	https://fflashgames.com/
flashplay.net	/api/action/	https://flashplay.net/api/action/
flashplay.net	/uninstall/	https://flashplay.net/uninstall/
flashplay.net	/api/config/	https://flashplay.net/api/config/
*	/*	http:///

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


25.2.55.3	IPv4	-
4.25.9.5	IPv4	-
2.15.6.1	IPv4	-
25.3.55.6	IPv4	-
1.15.25.25	IPv4	-
3.25.8.4	IPv4	-
1.45.7.6	IPv4	-
6.4.65.5	IPv4	-
5.6.4.4	IPv4	-

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Не работает на ВК вообще.

ОП

О��ьга Потанина·31 Mar 2023

Не работает на ВК вообще.

ОП

Ольга Потанина·31 Mar 2023

Не работ��ет на ВК вообще.

ОП

О��ьга Потанина·31 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Flash Player for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 13 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating