What our analysis found

Formula Rush Racing Game is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by other. It comes from a trusted publisher and was last updated in April 2026.

Key findings

• high· other —The bundled (and CWS-signed, per item_version 1.5.1) manifest declares `permissions: []` and `host_permissions: []`, while the live CWS listing manifest declares `identity` plus host access to ` and ` A racing game needs no Google OAuth identity token, and the added host is on the same `cloudapi.stream` domain recorded as the C2 for the Socket 108-extension session-theft campaign, so the escalation is the classic delayed-malicious pattern: ship a clean game, then push an update that requests token access and a C2 host. The mismatch also means the analysed archive cannot be used to clear the currently distributed build.
• high· other —Every install AND every update force-opens an operator-controlled page on cloudapi.stream, the C2 domain listed in the internal IoC notes for the Socket cloudapi.stream campaign, keyed by. Because it fires on `update` rather than only on first install, the operator gets a guaranteed, attributable browser visit each time a new build lands, which is a working delivery and victim-enumeration channel rather than a one-time welcome page. Combined with `externally_connectable: {"matches": ["<all_urls>"]}`, which exposes this extension's messaging surface to every website with no onMessageExternal listener yet present, the extension is pre-positioned for remote control by that same infrastructure.

The bundled v1.5.1 code is a stock CodeThisLab HTML5 racing game (,,) with unmodified Bootstrap, and its signed manifest declares zero permissions — but the live CWS listing for this item declares `identity`, ` and ` i.e. the listing has escalated past this snapshot into an OAuth-token-plus-C2 permission shape.:12/ already wires every install, update and uninstall to `cloudapi.stream`, the exact C2 recorded in the internal IoC notes for the Socket 108-extension session-theft campaign, and 58 of the publisher's 70 other extensions are flagged malicious; those corroborate the 0.98 ML score, while the 0.00 risk-engine score and chrome-stats are uninformative because they were computed over this stale, permission-free snapshot. Treat this as a clean pre-update decoy whose live version is part of the cloudapi.stream campaign, not as a benign game.