Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Gmail Append HTML

CRITICAL RISKRemoved from Chrome Web Store

Gmail Append HTML

ID: dnfikahmfhcjfcmbgbkklecekfeijmda

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.7.1

Size

0.02 MB

Rating

3.0/5

Reviews

Users

4,091

Type

Extension

Updated

Nov 2, 2022

Publisher Contextual Analysis

Trusted

Author: usefulwebtechView Profile
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 15303 Ventura Blvd Sherman Oaks, CA 91403 US

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

136,091

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Allows the usage of HTML content in Gmail from the context menu.

This extension allows the usage of HTML content in Gmail. Simply copy the content you wish to add, right click on email form and select Append clipboard as HTML. YOU MUST REFRESH THE GMAIL TAB AFTER INSTALLING THIS EXTENSION. PLEASE NOTICE: 1) This extension manipulates the html element inside your email, there's no guarantee of what will work as expected and what won't. Please send an email to yourself before sending to an important contact and check the result. Or even better, send the email to an account outside Gmail and see how it displays. 2) Images still needs to be hosted somewhere. 3) USE INLINE CSS. 4) I've created this extension as a PROOF OF CONCEPT mainly for personal usage, but it was working, so I decided to publish and possibly help someone in need. It lacks testing and unfortunately I don't have the time to work on it right now. Consider its use as is.

User Growth

Showing data from Jan 01, 2022 to Dec 22, 2022

Versions

+2.28%(+91 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 72 ratings+1 (1%)

Average Rating

Current: 2.99 / 5.0-0.04

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium0

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.7.1 Code review	6

Extension Version	Code Review Findings
1.7.1	6

Files with findings

3 distinct paths — top paths by unique finding count:

background.js4
content_script.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 68)	Every search query the user types into Google, Yahoo, or Bing is captured and exfiltrated to `ivetraininguk.info/search` along with the extension name, version, an obfuscated `_dd` token, and the raw query string. The…	1.7.1
2	Obfuscation	critical	background.js (line 1)	The background script defines a hardcoded external domain `ivetraininguk.info` and an obfuscated base64-like string `_dd` that is transmitted as a parameter to that domain. This domain is unrelated to the stated purpo…	1.7.1
3	Unauthorized Data Collection	critical	background.js (line 51)	The extension monitors navigation events across all URLs (the manifest injects content scripts on `http:///` and `https:///`) and specifically extracts search queries from Google, Yahoo, and Bing. This unauthorize…	1.7.1
4	Code Injection	high	content_script.js (line 34)	Clipboard content is read via `getClipboardText()` and then assigned directly to `innerHTML` without any sanitization. An attacker who controls the clipboard (e.g., via a malicious website that has written to it) can …	1.7.1
5	Privilege Escalation	high	manifest.json (line 5)	The content script is injected into every HTTP and HTTPS page the user visits, not just Gmail. This grants the extension access to the DOM of all websites (including banking, email, and other sensitive sites), which i…	1.7.1
6	Tracking	high	background.js (line 160)	A `webNavigation.onBeforeNavigate` listener fires on every top-level navigation across all tabs, feeding each URL into the search-hijack pipeline. This gives the extension complete visibility into the user's browsing …	1.7.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


mail.google.com	/*	http://mail.google.com/*
mail.google.com	/*	https://mail.google.com/*
*	/*	https:///
*	/*	http:///
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

The extension works ... but it contains some malicious code. E.g. redirect searches via https://goog.ivetraininguk.info to bing.com (and who knows what else...).

Milan Siebenbürger·6 Dec 2022

no funciona!!

Omar Galaviz·13 Jan 2022

No button is added to Gmail.

Jun O Kim·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Gmail Append HTML

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating