Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Floating Player

CRITICAL RISKRemoved from Chrome Web Store

Floating Player

ID: ekajjllcmeckibblgckgoceinmmgnfop

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.9

Size

0.20 MB

Rating

3.9/5

Reviews

774

Users

196,749

Type

Extension

Updated

Nov 28, 2022

Publisher Contextual Analysis

Trusted

Author: kremanov78193dView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

196,749

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Watch videos while you browse the internet. Works with YouTube™, Twitch.tv and others.

——————————————————— This extension will no longer be updated. Thank you for using "Floating Player"! Google Chrome 70 already has native Picture-in-Picture, so you don't need an extension anymore! Just create a new bookmark and add this code as URL: javascript:document.getElementsByTagName('video')[0].requestPictureInPicture(); ——————————————————— Source code and bug tracker are available at https://github.com/gabrielbarros/floating-player ——————————————————— Floating Player is a lightweight extension that lets you watch YouTube™ and Twitch videos while you browse the internet. How to open a popup? • Open the video page • Click the extension icon on the top right corner of Chrome —————————————————— READ THIS: - If you want the classic popup back, go to the options page and uncheck "use native picture in picture". - Most options don't work for native picture in picture. - You need to install Deskpins if you prefer the classic popup. —————————————————— Works with YouTube™, Twitch.tv and many others. —————————————————— Changelog https://raw.githubusercontent.com/gabrielbarros/floating-player/master/CHANGELOG

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-1.63%(-3,251 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 773 ratings

Average Rating

Current: 3.93 / 5.0-0.17

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium3

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.8 Code review	8

Extension Version	Code Review Findings
3.8	8

Files with findings

4 distinct paths — top paths by unique finding count:

js/options.js3
js/floating-player.js2
youtube.html2
js/background.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	high	js/options.js (line 500)	After enumerating all installed extensions via the hidden F9 handler, the extension uses chrome.management.setEnabled() to programmatically enable or disable other extensions by ID. The target extension ID is stored i…	3.8
2	Privilege Escalation	high	js/options.js (line 484)	A hidden `F9` key handler requests the powerful `management` permission and then uses it to disable another extension. Hidden triggers that unlock extension-management actions are suspicious because they are not part …	3.8
3	Remote Code Loading	high	youtube.html (line 28)	This extension page loads JavaScript directly from `https://www.youtube.com/iframe_api` instead of bundling all executable code locally. Remote script execution inside an extension page is a classic remote-code-loadin…	3.8
4	Unauthorized Data Collection	high	js/options.js (line 482)	A deliberately hidden 'secret' keypress handler (F9 key) silently requests the optional 'management' permission and then calls chrome.management.getAll() to enumerate every installed extension in the browser. While th…	3.8
5	Data Exfiltration	medium	js/floating-player.js (line 694)	The callExternalApp() function sends a cross-extension message containing the current popup URL and window dimensions to an extension whose ID is read from localStorage ('appid'). Any extension ID matching /^[a-z]{32}…	3.8
6	Network Interception	medium	js/background.js (line 17)	The extension registers a blocking webRequest listener that intercepts all outbound requests to YouTube embed URLs and rewrites the Referer header before they are sent. The 'blocking' + 'requestHeaders' mode gives it …	3.8
7	Other	medium	js/floating-player.js (line 694)	This function sends the active popup URL and window-control parameters to a separate extension ID, using either a hard-coded target or one stored in local storage. Cross-extension messaging like this creates an opaque…	3.8
8	Remote Code Loading	low	youtube.html (line 37)	The youtube.html page (which runs inside the extension's popup context with elevated chrome.* API access) loads a script directly from https://www.youtube.com/iframe_api at runtime. If YouTube's CDN were compromised o…	3.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.youtube.com	/watch	https://www.youtube.com/watch?v=
www.youtube.com	/oembed	https://www.youtube.com/oembed?url=
goo.gl	/QDERoA	https://goo.gl/QDERoA
www.youtube-nocookie.com	-	https://www.youtube-nocookie.com
www.youtube.com	-	https://www.youtube.com
www.youtube.com	/live_chat	https://www.youtube.com/live_chat
www.youtube.com	/embed	https://www.youtube.com/embed
www.youtube.com	/tv	https://www.youtube.com/tv
player.twitch.tv	-	https://player.twitch.tv
www.twitch.tv	/popout/	https://www.twitch.tv/popout/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Malware Redirects search results. Does it's best to prevent you from leaving a negative review. Nuke from orbit

Mike DiGiovanni·12 Jan 2023

this application is very suitable for me, but maybe it would be better to add a sub function

Hoàng Phi·5 Jan 2023

hijacks urls and goes to dodgy site and tries to reroute the link to this page

Sam Dean·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Floating Player

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating