Chrome Web StoreDo not install
Code review: critical (v2.0.420)
Our reviewer read version 2.0.420 of this extension and confirmed malicious behaviour. 3 security findings documented below. Do not install it. Remove it if you already have it.
396 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
GetEmail.io gets the email of anyone on Earth, used by 80,000 people, is rated malicious by Extension Auditor. Our code review reported 3 findings (1 critical, 1 high, 1 low), led by remote code loading. It comes from a trusted publisher and was last updated in October 2026.
Key findings
- Critical
Remote Code Loading
The extension fetches a list of tasks from the server (`askInvestigationTasks`) and then executes any function accessible on the `window` object specified by `task.module` and `task.method` with arbitrary `task.arguments`. This constitutes a full remote code execution backdoor, as the server can run any existing function or inject new behavior without updating the extension code. It is a critical security risk and clearly malicious.
- High
Unauthorized Data Collection
This function reads the base64-encoded value of localStorage key 'C_C_M' from the LinkedIn domain, which is likely set by another extension. The decoded value is included in the task results sent to the server (`reportInvestigationTasksResults`). This is unauthorized collection of data stored by other software, invading user privacy and serving no legitimate purpose for the email-finding extension.
- Low
Other
The bundled manifest lists the web accessible resource as ' ', but the live Chrome Web Store listing shows ' '. This mismatch may indicate an undisclosed change or a hidden script file, reducing transparency. It is a low-severity discrepancy.
Analyst notes
The extension contains a remote code execution capability in (lines 37-48) where it fetches tasks from the server and dynamically executes arbitrary functions using `window[task.module][task.method](task.arguments)`. This allows the server to run any code in the content script context without user consent or a code update. Additionally, the `LkDetect` task reads localStorage key 'C_C_M' (likely set by other extensions) and sends it to the server, constituting unauthorized data collection from a third-party. These features exceed the stated email-finding purpose and are inherently malicious. The manifest mismatch (web_accessible_resources filenames) is a minor corroborating indicator.
GetEmail.io gets the email of anyone on Earth Chrome extension security report
ID: hbnjdgffjfjbkdoghlpkedjfoddlgbge
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- PRESTALEADS
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://www.linkedin.com/*
396 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
GetEmail.io is the easiest way to find email addresses from anywhere on the web, with just one click.
Read the publisher’s full description
GetEmail.io is the easiest way to find email addresses for anyone across the web. With GetEmail.io, you’ll find the professional email address of anyone, whatever their company or position, in just one click. We have one of the highest success rates in finding emails with the lowest possible bounce rate. How? We're two top-tier French engineers who have applied advanced big data and machine learning algorithms to find the right email, every time. As a Dun & Bradstreet company, we're now teamed up with the global leader in commercial data and analytics. Our pricing is free for reasonable use, with additional paid options for more intensive use. Test and use GetEmail.io for free to see it for yourself. When it gives you an email, we’re confident it will be the right one!
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
396 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from PRESTALEADS
- GetEmail.io for Gmail/Outlook/Salesforce70,000 users
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools343,000,000 users
- Application Launcher For Drive (by Google)98,000,000 users
- AdBlock — block ads across the web65,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users