Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Flash Player for Web

CRITICAL RISKRemoved from Chrome Web Store

Flash Player for Web

ID: mcakfkioeanhfiojkchcndahgagcidbd

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.6.8

Size

0.09 MB

Rating

3.8/5

Reviews

128

Users

369,902

Type

Extension

Updated

Mar 8, 2021

Publisher Contextual Analysis

Author: Flash Player TeamView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

369,902

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Flash Player saves your favorite flashes and run them later.

Play Flash files anywhere across the WEB! Web Flash Player is a well design Chrome Extension, which allows you to add any flash (swf) file into the app's playlist and access them by simply clicking the icon. Simply navigate to the webpage, which hosts flash file, you want to play, open the Extension, choose from detected flash files and click the Add button. Voila! Flash file is saved and hosted in your playlist now, you can play it whenever you want! All flash games, videos and other files, added into Player are saved without quality loss, enjoy the original image and sound quality from the upper right corner of your Chrome Browser:)

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High10

Medium1

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6.8 Code review	6
1.6.7 Code review	6

Extension Version	Code Review Findings
1.6.8	6
1.6.7	6

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js9
js/iframe-access.js2
js/content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	js/background.js (line 1)	On extension install or update, the background script encodes the user's persistent UID, extension runtime ID, version, event action (reason), and timestamp into a base64 JSON blob and silently POSTs it to `http://pla…	1.6.7
2	Data Exfiltration	high	js/background.js (line 1)	All beacons are sent over plain HTTP (not HTTPS) to `playerflash.com`, making the communication trivially interceptable via MITM. More critically, the server response is trusted without any validation — if an attacker…	1.6.7
3	Network Interception	high	js/background.js (line 126)	This installs a blocking `onHeadersReceived` hook across `<all_urls>` and strips response headers whose names are supplied by remote config. Removing server-selected security headers from every site is a classic netwo…	1.6.8
4	Network Interception	high	js/background.js (line 146)	For each successful top-level page load, the extension derives the visited domain, queries a remotely templated affiliate/redirect endpoint, and may trigger follow-on background navigation logic based on the response.…	1.6.8
5	Network Interception	high	js/background.js (line 186)	This blocking request hook rewrites outgoing headers on all HTTP(S) traffic using values from a custom header and remote rule set. Modifying `Accept` and then conditionally deriving follow-up referer logic is not nece…	1.6.8
6	Other	high	js/background.js (line 98)	The extension periodically posts a persistent unique ID, extension ID, version, and timestamp to `playerflash.com`, then applies whatever JSON configuration the server returns. That gives the remote service ongoing co…	1.6.8
7	Remote Code Loading	high	js/iframe-access.js (line 77)	This code injects a remote Mixpanel script from a CDN into page/iframe contexts when enabled by server-provided config, and it can also copy arbitrary `pageOptions` onto `window` beforehand. Loading executable code fr…	1.6.8
8	Tracking	high	js/background.js (line 356)	The background processor can open URLs in hidden tabs and automatically close them later, then upload the full redirect chain to a remote logging endpoint. Hidden navigation plus exfiltration of visited URL chains is …	1.6.8
9	Tracking	high	js/background.js (line 1)	The extension generates and persistently stores a unique user identifier (UUID) in `chrome.storage.local` on first run. This UID is included in every beacon sent to playerflash.com, enabling long-term cross-session tr…	1.6.7
10	Tracking	high	js/background.js (line 1)	The extension registers an uninstall tracking URL that, upon removal, beacons the user's persistent UID, extension ID, version, and timestamp to playerflash.com. The payload is base64-encoded to obscure its content fr…	1.6.7
11	Tracking	high	js/content.js (line 1)	When a user plays any Flash content over HTTPS, the extension silently rewrites the `src` URL through `https://playerflash.com/redirect.php?url=<original>`. This routes every Flash URL through the operator's server, a…	1.6.7
12	Unauthorized Data Collection	medium	js/iframe-access.js (line 1)	This script runs inside ALL frames (manifest sets `all_frames: true`) and polls every second scanning every `<embed>` and `<object>` element on every page and every iframe the user visits. It extracts and transmits th…	1.6.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

does not work at all, does absolutely nothing

Klára Priehradníková·17 Mar 2021

i don't know how to make it worked i keep putting in the url but i cant go in and see the flash

Luis aguilar·10 Mar 2021

this was not helpful after adobe flash died i tried looking for things that can replace it but im not really finding anything can some suggest me a flash player or something like adobe? :)

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Flash Player for Web

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews