Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Flow

CRITICAL RISKRemoved from Chrome Web Store

Flow

ID: bapoeoceggfnnoomenaapjkofjlpmbeh

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇹🇼Chinese (Traditional)

🇩🇰Danish

🇺🇸English

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇮🇹Italian

🇳🇴Norwegian

🇪🇸Spanish

🇸🇪Swedish

Extension Info & Metadata

Status

Removed

Version

3.5.17

Size

0.03 MB

Rating

4.0/5

Reviews

106

Users

1,000,000

Type

Extension

Updated

Oct 22, 2021

Publisher Contextual Analysis

Author: FlowView Profile
Privacy: Privacy Policy
Country: IL
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 3 Haimahot street Ness Ziona 7402558 IL

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,008,076

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Flow enhances your search experience by adding additional relevant search results.

Some of these results may be sponsored. It gives you more choice to find what you're looking for. You will see our Search results in the north of Google results. We recommend that you read our privacy policy and terms of use to read about everything we're doing to protect your privacy. We are supporting Europe, Asia and South America. Find a complete list of supported countries on our website at https://flowext.com/support/

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High6

Medium6

Low1

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.5.16 Code review	6
3.5.15 Code review	9

Extension Version	Code Review Findings
3.5.16	6
3.5.15	9

Files with findings

2 distinct paths — top paths by unique finding count:

features.js8
background.js7

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	background.js (line 70)	This function iterates every open window and every tab (skipping only chrome:// scheme URLs) and programmatically injects features.js via chrome.tabs.executeScript. The manifest declares content_scripts only for Googl…	3.5.15
2	Remote Code Loading	critical	features.js (line 134)	When the ad server response includes a Yahoo beacon element, the extension dynamically executes an inline script that fires 1x1 pixel tracking beacons to search.yahoo.com and xmlp.search.yahoo.com, encoding the full p…	3.5.15
3	Code Injection	high	features.js (line 130)	The extension fetches remote content from its backend and directly injects server-supplied HTML into a DOM container via `innerHTML`, while also hiding page elements. This gives the remote service control over what ge…	3.5.16
4	Other	high	features.js (line 22)	The extension replaces Google's native result statistics text ("About X results") with its own "Ads by flow" label, deliberately styling the link in Google's muted grey color (#70757a) to visually blend in with the na…	3.5.15
5	Tracking	high	background.js (line 1)	On install, the extension silently beacons to querilis.com/track/install.php with the extension ID, then fetches a persistent cohort identifier from querilis.com/track/cohort.php using `xhr.withCredentials = true`. Th…	3.5.15
6	Unauthorized Data Collection	high	features.js (line 297)	This content script extracts the user's Google search query from the page URL and sends it to a remote server, along with persistent install metadata (`install_time`, `cohort`) and extension version identifiers. That …	3.5.16
7	Unauthorized Data Collection	high	background.js (line 123)	Every user search query on Google is sent to querilis.com via trackFeature('search', keyword) (triggered by features.js line 223), combined with the install timestamp and persistent cohort ID. Using `withCredentials: …	3.5.15
8	Unauthorized Data Collection	high	features.js (line 223)	For every Google search with a query longer than 2 characters, the extension sends the raw keyword to the background script for exfiltration to querilis.com, then also forwards it to flowsurfv3.net along with the coho…	3.5.15
9	Obfuscation	medium	features.js (line 11)	The code mutates the global String prototype by adding a `.t()` method (a Fisher-Yates shuffle), then uses it to generate an obfuscated random token from the current timestamp. Polluting String.prototype affects all s…	3.5.15
10	Other	medium	features.js (line 222)	This logic rewrites Google's results page to insert server-provided sponsored blocks and relabel the page as ads related to the user's query. That is consistent with search-result hijacking/ad injection behavior, espe…	3.5.16
11	Tracking	medium	features.js (line 164)	This block builds a hidden 1x1 pixel beacon and transmits the current page URL and referrer to Yahoo-owned endpoints when instructed by remote content. It is third-party tracking code embedded into search pages and op…	3.5.16
12	Tracking	medium	background.js (line 6)	On installation, the extension immediately contacts remote tracking endpoints, assigns the user to a remotely controlled cohort, and persists that identifier in sync storage. The use of `withCredentials` plus cohort a…	3.5.16
13	Tracking	medium	background.js (line 97)	The background script instruments both uninstall events and feature usage, forwarding those events together with persistent identifiers to remote endpoints. In this extension, `trackFeature` is used for search terms, …	3.5.16
14	Tracking	medium	background.js (line 52)	On first install, the extension forcibly opens a new tab to mysearchflow.com (the same domain used for ad delivery) and closes all popup windows via closeCwsWindows(). This silently dismisses the Chrome Web Store inst…	3.5.15
15	Tracking	low	background.js (line 90)	The uninstall URL is set to mysearchflow.com and encodes the install timestamp and cohort identifier. When a user removes the extension, their browser automatically navigates to this URL, confirming the removal event …	3.5.15

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

196

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


querilis.com	/track/install.php	https://querilis.com/track/install.php?extid=
querilis.com	/track/cohort.php	https://querilis.com/track/cohort.php?extid=
flowext.com	/extension-installed.php	https://flowext.com/extension-installed.php?extid=
flowext.com	/extension-uninstall.php	https://flowext.com/extension-uninstall.php?extid=
querilis.com	/track/evt.php	https://querilis.com/track/evt.php?extid=
flowext.com	/privacy.php	https://flowext.com/privacy.php
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.google.com	/*	https://www.google.com/*
www.google.ad	/*	https://www.google.ad/*
www.google.ae	/*	https://www.google.ae/*

Showing 1 to 10 of 200 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

muy buena

Jetli Francisco Acuña Mendieta·23 Nov 2021

Im happy user 5 star

Landry Rosales·22 Nov 2021

It works quickly and seamlessly in the background. Love it.

Amalia Mckee·22 Nov 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Flow

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews