Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Flash Player for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Flash Player for Chrome

ID: oakbcaafbicdddpdlhbchhpblmhefngh

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇬🇧British English

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇵🇹Portuguese

🇪🇸Spanish

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

2.2

Size

9.67 MB

Rating

4.1/5

Reviews

237

Users

600,000

Type

Extension

Updated

Jan 23, 2025

Publisher Contextual Analysis

Trusted

Author: https://flash2022.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

600,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Emulator for Flash Player that runs flash files using Ruffle. It's a simple way to run your favorite flash content across the web!

Flash Player for Web is an emulator that runs your favorite flashes using Ruffle. All flash games, videos, and other files are converted into an alternative format in order to open them in a browser. Play video, game, and gif files in this format anywhere across the WEB! Well, design Chrome Extension, which allows you to add any (SWF) file into the app's playlist and access them by simply clicking the icon. This is totally free extension for you. Flash Player is an excellent player tool. It supports all formats and HD flashes files. Want to play a game that you found on your favorite gaming website but can't run due to the "Adobe Flash Player is no longer supported" error? Then this Chrome tool will be useful for you. How it works: 1. Go to a site with flash games. 2. Click the extension logo. 2. Enable the extension (blue checkbox on the right top). 3. Reload the webpage. 4. Click on the Play button. 5. Enjoy! Warning: Flash Player is a helper tool for Google Chrome users. Our extension is not officially affiliated with products Adobe Player or any others Adobe products. Flash Player for Chrome cooperates with Natutti LTD By installing our extension you agree to our internal Privacy Policy and also automatically agree to the Privacy Policy and Terms of Use of the Natutti platform https://natutti.net/privacy-policy.html and https://natutti.net/terms-of-use.html

User Growth

Showing data from Jan 01, 2022 to Jan 08, 2023

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 2.00 / 5.0-3.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium6

Low0

Versions scanned

Showing 2 of 12 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1 Code review	4
1.0 Code review	6

Extension Version	Code Review Findings
1.1	4
1.0	6

Files with findings

5 distinct paths — top paths by unique finding count:

js/background.js4
bg.js2
manifest.json2
dist/lv0.js1
js/content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 8)	Every user bookmark URL is transmitted to the third-party service sshot.org via an authenticated HTTP GET request. The request includes the full bookmark URL as a query parameter, giving sshot.org a real-time record o…	1.0
2	Code Injection	high	manifest.json (line 38)	The manifest explicitly opts into 'unsafe-eval', which permits dynamic code execution via eval(), new Function(), and similar constructs within the extension's privileged pages. Chrome extensions are denied unsafe-eva…	1.0
3	Tracking	high	bg.js (line 8)	The background page sends installation lifecycle events plus a persistent generated `uid` to `https://flash2022.com/api/action/index.php`. More concerning, it then trusts a server-controlled JSON response and opens `t…	1.1
4	Unauthorized Data Collection	high	js/background.js (line 8)	Hardcoded plaintext API credentials (username: 'user', password: '8HS8YRiVPnv6uS') are embedded directly in the bundled extension source and used to authenticate to sshot.org. Baking credentials into shipped code is a…	1.0
5	Code Injection	medium	dist/lv0.js (line 142)	The content script injects executable code directly into every visited page's main JavaScript context by creating `<script>` elements and appending the fetched runtime source as text. Even though the fetched file is l…	1.1
6	Other	medium	manifest.json (line 15)	The manifest grants the extension the ability to run on all URLs, in all frames, at `document_start`, before page code finishes loading. In combination with `web_accessible_resources` and a CSP that permits `unsafe-ev…	1.1
7	Tracking	medium	bg.js (line 28)	This code registers an uninstall URL that embeds the extension ID, version, timestamp, and a persistent unique identifier. That enables user-level tracking when the extension is removed and is not necessary for the ad…	1.1
8	Tracking	medium	js/background.js (line 8)	On installation, the extension immediately opens a tracking URL (flashtab.net/install/) in a new browser tab without user interaction, allowing the operator to record each new install with browser fingerprint and refe…	1.0
9	Tracking	medium	js/background.js (line 8)	The extension generates a persistent unique user ID on first run and stores it in chrome.storage.local indefinitely. This ID survives browser sessions and can be correlated with the bookmark URL requests sent to sshot…	1.0
10	Unauthorized Data Collection	medium	js/content.js (line 1)	A content script injected into all unsplash.com pages scrapes the src, srcset, and sizes attributes of photos a user views and immediately relays them to the background page via chrome.runtime.sendMessage. While the o…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


flash2022.com	/contact	https://flash2022.com/contact
flash2022.com	/install	https://flash2022.com/install
stuartk.com	/jszip	http://stuartk.com/jszip
raw.github.com	/Stuk/jszip/main/LICENSE.markdown.	https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.
github.com	/nodeca/pako/blob/main/LICENSE	https://github.com/nodeca/pako/blob/main/LICENSE
stuk.github.io	/jszip/documentation/howto/read_zip.html	https://stuk.github.io/jszip/documentation/howto/read_zip.html
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
github.com	/ruffle-rs/ruffle/wiki/Frequently-Asked-Questions-For-Users	https://github.com/ruffle-rs/ruffle/wiki/Frequently-Asked-Questions-For-Users#chrome-hardware-acceleration
example.com	-	https://example.com

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


25.2.55.3	IPv4	-
4.25.9.5	IPv4	-
2.15.6.1	IPv4	-
25.3.55.6	IPv4	-
1.15.25.25	IPv4	-
3.25.8.4	IPv4	-
1.45.7.6	IPv4	-
6.4.65.5	IPv4	-
5.6.4.4	IPv4	-

3.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

работает!

Moth Tyan·24 Jan 2025

Doesn't work.

Max Tolstokorov·17 Nov 2024

Funcionando 28/10/2024 (Jogando DDTank)

Okdok·29 Oct 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Flash Player for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 12 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating