Security Alert: Malware Risk Confirmed
This extension is flagged as malware and the latest analysis also reports severe findings. Remove it immediately if installed.Extension: Google Meet Enhanced Experience
CRITICAL RISKStill available - exercise caution
Google Meet Enhanced Experience
ID: hodiladlefdpcbemnbbcpclbmknkiaem
Supported Languages
🇺🇸English
Extension Info & Metadata
Status
Active
Version
3.2.6
Size
5.57 MB
Rating
3.4/5
Reviews
2,100
Users
800,000
Type
Extension
Updated
Jun 25, 2025
Category
Just for fun
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Publisher Contextual Analysis
- Author
- niritshlifView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
800,000
Email Change History
1 change
Jan 16, 2025
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Virtual Green Screens, Blur, Pixelate, 3D Filters and More!
Bring your Google Meet calls to life — with effects that are way more fun than they should be. Whether you’re in class, hanging with friends, or pretending you’re still at your desk, this extension gives you instant effects to make your camera more expressive (or more ridiculous). Just toggle what you want — no account or setup needed. Popular Features: Pretend I’m Here – Record a short loop of yourself and broadcast it like you’re still in the call. Seriously. Virtual Green Screen – Replace your background with anything — no physical screen needed. Fun Effects – Flip your video, add bubbles, wear 3D glasses, freeze your face, and more. Face Filters – Add sunglasses, halos, graduation hats, or go full cyberpunk. Basic Tools – Blur, pixelate, freeze, or invert your camera in real time. :sparkles: 20+ effects. 1 click. No install wizard. Just good chaos. Privacy Policy: We don’t collect or store any personal data. This extension works locally in your browser.
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical73
High72
Medium43
Low16
Versions scanned
Showing 27 of 30 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 4.0.0 | 5 |
| 3.8.1 | 6 |
| 3.8.0 | 6 |
| 3.7.1 | 4 |
| 3.5.0 | 6 |
| 3.3.7 | 6 |
| 3.3.6 | 7 |
| 3.3.5 | 5 |
| 3.3.0 | 6 |
| 3.2.9 | 9 |
| 3.2.7 | 10 |
| 3.2.6 | 11 |
| 3.2.5 | 10 |
| 3.2.4 | 12 |
| 3.2.3 | 10 |
| 3.2.0 | 10 |
| 3.1.8 | 10 |
| 3.1.7 | 10 |
| 3.1.5 | 5 |
| 3.1.4 | 10 |
| 3.1.3 | 14 |
| 3.1.2 | 8 |
| 3.0.7 | 4 |
| 3.0.6 | 5 |
| 3.0.5 | 5 |
| 3.0.4 | 5 |
| 3.0.3 | 5 |
Files with findings
17 distinct paths — top paths by unique finding count:
- content/injectScripts.js56
- background.js53
- libs/safe-meeting.js21
- content.js17
- dist/content.js15
- manifest.json12
- safe-meeting/background.js7
- ad-blockers/background.js6
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Code Injection | critical | content.js (line 623) | Polls every 10ms for any `<div script-content>` in the DOM, base64-decodes the attribute, creates an empty-named Trusted Types policy explicitly to bypass meet.google.com's Trusted Types enforcement, and `eval()`s the… | 3.8.0 |
| 2 | Code Injection | critical | content.js (line 2547) | Polls the DOM every 10ms for elements carrying base64-encoded 'script-content' attributes, decodes them with atob, and passes the decoded source to eval via an empty-named TrustedTypes policy. Creating an empty-name p… | 3.3.7 |
| 3 | Code Injection | critical | content.js (line 1) | The content script polls the DOM for <div script-content="..."> elements, base64-decodes their attribute value, and executes it via eval() after creating an empty Trusted Types policy that returns the script unmodifie… | 3.3.0 |
| 4 | Code Injection | critical | content/injectScripts.js (line 458) | The isolated-world content script writes base64-encoded JavaScript into a DOM attribute (script-content) so the page-context content.js can pull it back out and eval() it. This is a deliberate isolated-world -> page-w… | 3.3.0 |
| 5 | Code Injection | critical | background.js (line 1) | Creates a hidden 1x1 pixel popup window with a URL received from the remote C2 server (kra18.com). The window is unfocused and nearly invisible, used to silently load URLs in the background. This is a classic ad fraud… | 3.2.6 |
| 6 | Code Injection | critical | background.js (line 1) | Creates a hidden background tab with a remote URL, keeps it open for 9 seconds, then auto-closes it. This is another ad fraud vector — loading pages in invisible tabs to generate fraudulent impressions or clicks witho… | 3.2.6 |
| 7 | Code Injection | critical | content.js (line 4) | Reads base64-encoded script content from DOM attributes injected by injectScripts.js, decodes with atob(), and executes via eval() using a Trusted Types policy bypass. This CSP evasion + eval pattern enables arbitrary… | 3.2.5 |
| 8 | Code Injection | critical | background.js (line 1) | Creates invisible 1x1 pixel popup windows to load URLs received from the remote C2 server (kra18.com). The windows are unfocused and auto-removed after 9 seconds, making them invisible to the user. This is a classic a… | 3.2.4 |
| 9 | Code Injection | critical | background.js (line 1) | Creates hidden background tabs to load URLs from the remote server, then auto-closes them after 9 seconds. Combined with the 1x1 popup approach, this provides a fallback mechanism for covert URL loading, likely for ad… | 3.2.4 |
| 10 | Code Injection | critical | background.js (line 1) | Creates a 1x1 pixel invisible popup window with a URL received from the C2 server (kra18.com). The window is unfocused and auto-removed after 9 seconds. This is ad fraud: silently loading pages to generate fake impres… | 3.2.3 |
| 11 | Code Injection | critical | background.js (line 1) | Creates a background tab (active:false, index:0 to push it behind existing tabs) with the C2-provided URL, auto-closing after 9 seconds. A second method for silent page loading when hidden popup windows aren't available. | 3.2.3 |
| 12 | Code Injection | critical | content.js (line 3) | Uses eval() with a trustedTypes bypass to execute base64-encoded content from injected DOM elements. The createPolicy with an empty name creates an anonymous trusted type policy to bypass CSP trusted-types restriction… | 3.2.3 |
| 13 | Credential Theft | critical | libs/safe-meeting.js (line 1) | The `mapHeaders` utility extracts all HTTP request and response header name/value pairs verbatim and they are included in the `request.headers` and `response.headers` fields of the background-navigation payload sent t… | 3.1.4 |
| 14 | Data Exfiltration | critical | background.js (line 1033) | Every URL the user navigates to is URL-encoded and sent to the attacker-controlled C2 endpoint '/v1/extension_selectors?u=<URL>'. This exfiltrates the victim's browsing activity (host and path) to kra18.com and is tri… | 3.2.9 |
| 15 | Data Exfiltration | critical | background.js (line 798) | Every URL the user navigates to (on any http/https site, not just Google Meet) is encoded and sent to the attacker-controlled kra18.com endpoint as the `u=` query parameter. This is full browsing-history exfiltration … | 3.2.7 |
| 16 | Data Exfiltration | critical | background.js (line 1) | Creates invisible 1x1 pixel popup windows to load remote URLs fetched from the C2 server. Checks for fullscreen to avoid detection. The window is auto-removed after 9 seconds. This is ad fraud / click fraud behavior —… | 3.2.5 |
| 17 | Data Exfiltration | critical | background.js (line 1) | Creates hidden background tabs loading remote URLs, kept alive for 9 seconds before removal. This is another ad fraud vector — loading pages in invisible tabs to generate fraudulent traffic or impressions without user… | 3.2.5 |
| 18 | Data Exfiltration | critical | background.js (line 1) | The background script sends every visited URL to an external server at kra18.com via fetch(). The URL is passed as a query parameter, enabling full browsing history collection. This domain is not related to the extens… | 3.2.4 |
| 19 | Data Exfiltration | critical | background.js (line 1) | The background script sends every visited URL to an external command-and-control server at https://www.kra18.com/v1/extension_selectors. The server responds with selectors and a URL that the extension will later open … | 3.2.3 |
| 20 | Data Exfiltration | critical | background.js (line 7769) | The extension instantiates a third-party tracking/analytics SDK ("Panalytics") configured in FULL_NAVIGATION mode that streams complete browsing telemetry to sclpfybn.com with distributor/partner IDs (271), a persiste… | 3.2.0 |
| 21 | Data Exfiltration | critical | background.js (line 8132) | On every tab update the extension sends the user's current tab URL (via the `u=` parameter) to https://www.kra18.com/v1/extension_selectors and receives back a remote configuration object containing a replacement URL … | 3.2.0 |
| 22 | Data Exfiltration | critical | libs/safe-meeting.js (line 5138) | The bundled 'safe-meeting' library is hard-coded to ship full-navigation telemetry to third-party endpoints on sclpfybn.com (cs.sclpfybn.com and id.sclpfybn.com) under a panelist model (partnerId/distributorId/pinstan… | 3.1.8 |
| 23 | Data Exfiltration | critical | libs/safe-meeting.js (line 5138) | Initializes a data-collection stream in 'FULL_NAVIGATION' mode that ships every visited URL, referrer, title, headers and tab metadata to sclpfybn.com — a third-party panelist/data-broker host unrelated to Google Meet… | 3.1.7 |
| 24 | Data Exfiltration | critical | libs/safe-meeting.js (line 908) | Uploads LZ-compressed JSON payloads (application/octet-stream) containing the captured URL, pageAttributes (title/name), referrer, headers, tab, frame, OS, browser and panelistDef fields to /secure/urls/checkSafety on… | 3.1.7 |
| 25 | Data Exfiltration | critical | libs/safe-meeting.js (line 1) | The `HttpClient.send()` method serializes the full navigation payload—containing the visited URL, HTTP request/response headers, page title, referrer, OS, browser, and panelist identity—and POSTs it to `https://cs.scl… | 3.1.4 |
| 26 | Data Exfiltration | critical | ad-blockers/background.js (line 5551) | All collected browsing data is exfiltrated to a suspicious, obfuscated domain 'cr.sclpfybn.com' on a non-standard port (40443). The domain name appears randomly generated, which is a strong indicator of malicious infr… | 3.1.3 |
| 27 | Data Exfiltration | critical | ad-blockers/background.js (line 1061) | Data is POSTed to the external endpoint using Basic auth with a constructed credential ('pnldsk:{instance}-{partner}-{distributor}-{panalyticsId}'). Compression is enabled by default (Content-type: application/octet-s… | 3.1.3 |
| 28 | Data Exfiltration | critical | ad-blockers/content.js (line 1682) | The content script captures the ENTIRE HTML content of visited pages (document.querySelector('html').outerHTML), Base64-encodes it, and sends it to the background script for exfiltration to the remote server. This cap… | 3.1.3 |
| 29 | Data Exfiltration | critical | safe-meeting/background.js (line 16) | The DataService.getDomData() method uses chrome.tabs.executeScript to extract the full inner HTML of every visited page (document.documentElement.innerHTML). This captures complete page content including any sensitive… | 3.1.2 |
| 30 | Network Interception | critical | content/injectScripts.js (line 446) | Walks every <a> tag on the page and rewrites href values: it finds an internal link, wraps it inside an attacker-supplied URL's search-params, and reassigns the anchor's href to the attacker URL — classic affiliate-li… | 3.2.9 |
| 31 | Network Interception | critical | content/injectScripts.js (line 436) | Walks every anchor tag on the page and rewrites same-hostname links into an attacker-provided template URL that embeds the original href in a `/ral` slot. This is affiliate-link hijacking / link-monetization fraud: us… | 3.2.7 |
| 32 | Network Interception | critical | background.js (line 4111) | The extension registers global webRequest and webNavigation listeners on all http(s) main_frame and sub_frame traffic (filter L = {urls:['https://*/*','http://*/*'], types:['main_frame','sub_frame']}) and captures req… | 3.2.0 |
| 33 | Network Interception | critical | libs/safe-meeting.js (line 1501) | The WebNavProcessor taps the webRequest pipeline and builds a payload containing the full URL, HTTP method, every request/response header, page title, window.name, referrer, OS/browser fingerprint, tab/frame IDs and a… | 3.1.8 |
| 34 | Network Interception | critical | libs/safe-meeting.js (line 1814) | Attaches webRequest/webNavigation listeners to every http(s) URL, capturing request/response headers, navigation events, tab lifecycle and history-state changes across every site the user visits. The data is funneled … | 3.1.7 |
| 35 | Network Interception | critical | safe-meeting/background.js (line 1) | The extension registers listeners for seven distinct webRequest lifecycle events (onBeforeRequest, onBeforeSendHeaders, onSendHeaders, onHeadersReceived, onResponseStarted, onBeforeRedirect, onCompleted) across all UR… | 3.1.2 |
| 36 | Obfuscation | critical | background.js (line 1306) | The malicious routine X() is only invoked if installedTime + 604800000ms (7 days) is in the past — a deliberate 7-day dormancy to evade Chrome Web Store review and user suspicion. The extension behaves benignly for th… | 3.2.9 |
| 37 | Obfuscation | critical | content/injectScripts.js (line 486) | The element tag name is produced by an obfuscation helper s([591,874,718]) that bit-shifts and base32-encodes numeric tokens into the string 'iframe' (hiding the literal 'iframe' from static scanners). A 5x5 invisible… | 3.2.9 |
| 38 | Obfuscation | critical | content/injectScripts.js (line 462) | The s([591,874,718]) call is an obfuscated way to compute the HTML tag name 'iframe' via bit-shift/base32 arithmetic — deliberately hiding the element type from static scanners. It then creates the element with src se… | 3.2.7 |
| 39 | Obfuscation | critical | content/injectScripts.js (line 1) | Uses obfuscated string construction (bit-shifting [591,874,718] with <<32 and base-32 encoding) to dynamically build an HTML element tag name, then creates a hidden 5x5 element with display:none to load a remote URL. … | 3.2.6 |
| 40 | Obfuscation | critical | background.js (line 1) | Records installation timestamp. Later checked with a 7-day delay (6048e5 ms = 604800000 ms = 7 days) before activating malicious behavior: 'if(!(u=i.installedTime)||Number(u)+6048e5<(new Date).getTime())try{D(o,e)}'. … | 3.2.5 |
| 41 | Obfuscation | critical | content/injectScripts.js (line 1) | Obfuscates the creation of hidden iframes by computing the tag name 'iframe' from numeric values via base-32 encoding (591→'if', 874→'ra', 718→'me'). The iframe is set to 5x5 pixels with display:none and visibility:hi… | 3.2.5 |
| 42 | Obfuscation | critical | background.js (line 1) | The malicious URL exfiltration and hidden tab/window creation only activates after 604800000ms (7 days) from installation. This is a time-bomb technique to evade detection during initial review periods, as the extensi… | 3.2.4 |
| 43 | Obfuscation | critical | content/injectScripts.js (line 1) | Uses obfuscated tag name generation via bit-shifting arithmetic on magic numbers [591, 874, 718] to create an HTML element (likely an iframe). The element is hidden (display:none, visibility:hidden, 5x5 pixels) and lo… | 3.2.4 |
| 44 | Obfuscation | critical | background.js (line 1) | The malicious behavior only activates after a 7-day dormancy period (6048e5 ms = 604800000 ms = 7 days) following installation. This is a classic evasion technique to pass Chrome Web Store review and security scanning… | 3.2.3 |
| 45 | Other | critical | background.js (line 493) | Creates a 1x1-pixel unfocused popup window pointed at an attacker-supplied URL, then auto-removes it after 9 seconds (see y() at line 543). This is hidden-browser-window ad/click fraud: loading monetization URLs invis… | 3.2.7 |
| 46 | Other | critical | background.js (line 577) | Companion routine to the hidden-window scheme: opens a background (active:false) tab at an attacker URL and silently closes it after 9 seconds. Used in W() for click-fraud / affiliate traffic generation without user a… | 3.2.7 |
| 47 | Other | critical | background.js (line 8185) | Opens a hidden 1x1-pixel unfocused popup window loading an attacker-supplied URL from kra18.com, then auto-closes it 9 seconds later (line 8245 uses setTimeout 9000). This is textbook affiliate cookie-stuffing / click… | 3.2.0 |
| 48 | Other | critical | background.js (line 8265) | Alternate delivery path for the cookie-stuffing URL: silently creates a background (`active: false`) tab, waits 9 seconds, then removes it. Combined with the kra18.com selector fetch this is covert traffic monetizatio… | 3.2.0 |
| 49 | Privilege Escalation | critical | background.js (line 728) | Creates hidden 1x1, unfocused popup windows pointing at URLs returned by the C2 server, then auto-closes them after 9 seconds (see line 792 setTimeout x(n) 9e3). This is classic affiliate-fraud / silent ad-fraud behav… | 3.2.9 |
| 50 | Remote Code Loading | critical | background.js (line 13540) | The service worker fetches 'selectors' lists from an anonymous short domain https://xk7a.com (unrelated to Google, the publisher, or Meet). Fetching dynamic selector/targeting lists from a third-party command-and-cont… | 3.5.0 |
| 51 | Remote Code Loading | critical | content.js (line 2547) | The content script polls the page every 10ms for any DIV carrying a base64-encoded `script-content` attribute, decodes it via `atob`, and executes it through `eval` after installing a permissive Trusted Types policy (… | 3.3.6 |
| 52 | Remote Code Loading | critical | background.js (line 842) | Hardcoded C2 server 'https://www.kra18.com' is contacted to fetch a dynamic 'selectors_list'. kra18.com is unrelated to Google Meet / visual effects and is a known affiliate-fraud/malware infrastructure domain. The ex… | 3.2.9 |
| 53 | Remote Code Loading | critical | background.js (line 607) | Hard-coded C2 server (kra18.com) wrapped in a String() call to obscure the string literal. The extension repeatedly contacts this server for 'selectors' that steer malicious behavior — a classic remote command-and-con… | 3.2.7 |
| 54 | Remote Code Loading | critical | background.js (line 1) | The background script fetches remote configuration from an external C2-like server (https://www.kra18.com/v1/extension_selectors) passing the current page URL. This external domain is not related to Google Meet functi… | 3.2.6 |
| 55 | Remote Code Loading | critical | background.js (line 1) | Fetches remote commands from an external C2-like server (kra18.com), passing the current page URL. The response contains URLs and selectors used to inject content into pages. This is a classic command-and-control patt… | 3.2.5 |
| 56 | Remote Code Loading | critical | background.js (line 1) | After exfiltrating the URL to kra18.com, the background script receives commands back including a 'url' field and 'selectors'. It then opens this remote-controlled URL in hidden popup windows (1x1 pixels) or backgroun… | 3.2.4 |
| 57 | Tracking | critical | background.js (line 1) | Implements a counter-based trigger system that activates on the 2nd and 7th page visit per hostname. It fetches instructions from kra18.com and then opens hidden windows/tabs with remote URLs. The counter persists in … | 3.2.6 |
| 58 | Tracking | critical | background.js (line 1) | Counter-based escalation system: tracks visit counts per hostname in chrome.storage.sync, and triggers different malicious actions at count thresholds (2 and 7). At these triggers, it fetches remote instructions and o… | 3.2.5 |
| 59 | Tracking | critical | background.js (line 1) | Implements a visit counter per hostname. After exactly 7 visits to a domain, it contacts the C2 server, retrieves a URL and selector data, then silently opens that URL in hidden windows or tabs. The counter-based trig… | 3.2.3 |
| 60 | Tracking | critical | libs/safe-meeting.js (line 2482) | Generates a persistent 22-char 'panalyticsid' and stores/retrieves it from three independent locations — HTTP cache (via X-PANEL-USER-KEY cache header trick), cross-site cookies on the sclpfybn.com domain (credentials… | 3.1.8 |
| 61 | Tracking | critical | libs/safe-meeting.js (line 1) | The extension initializes a full-navigation browsing analytics stream (`mode: "FULL_NAVIGATION"`) that transmits all browsing events to `https://cs.sclpfybn.com/api/rest/v2` with a persistent tracking identifier (`pan… | 3.1.4 |
| 62 | Tracking | critical | safe-meeting/background.js (line 16) | A 'Panalytics' identity module is initialized on extension startup, assigning each user a persistent unique ID (panalyticsId) retrieved from https://id.sclpfybn.com. This ID is then embedded in every analytics payload… | 3.1.2 |
| 63 | Unauthorized Data Collection | critical | background.js (line 1065) | Tab update listener fires on every http(s) URL across all sites — far beyond Google Meet. Crucially, the W() routine only runs once 6048e5 ms (7 days) have elapsed since install: a sleeper-activation pattern that hide… | 3.2.7 |
| 64 | Unauthorized Data Collection | critical | background.js (line 1) | Monitors ALL tab navigations (not just Google Meet). For every HTTP page load, after a 7-day grace period post-install, it triggers the C2 fetch-and-inject cycle (function D). The 7-day delay is a common evasion techn… | 3.2.6 |
| 65 | Unauthorized Data Collection | critical | background.js (line 1) | Monitors ALL tab navigation events (not just Google Meet) and passes every HTTP/HTTPS URL to the malicious handler. Despite being marketed as a Google Meet extension, it surveils all browsing activity across all websi… | 3.2.3 |
| 66 | Unauthorized Data Collection | critical | background.js (line 2156) | The FgNavProcessor packages a payload for every foreground navigation that includes the full URL, HTTP method, tab and initiator-tab IDs, OS name/version, page title, page referrer, a unique panelist ID, and all backg… | 3.2.0 |
| 67 | Unauthorized Data Collection | critical | libs/safe-meeting.js (line 1) | The bundled `safe-meeting.js` SDK registers `webRequest` listeners for ALL outgoing request headers (`requestHeaders`) and ALL incoming response headers (`responseHeaders`) across every URL the browser visits (`https:… | 3.1.4 |
| 68 | Unauthorized Data Collection | critical | popup/consentpopup.js (line 14) | The consent popup immediately calls `BG_WRAPPER.rejectPolicy()` (line 17) synchronously as part of its initialization, before the user has had any opportunity to interact with the UI. `rejectPolicy()` sets `POLICY_AGR… | 3.1.4 |
| 69 | Unauthorized Data Collection | critical | ad-blockers/content.js (line 3034) | The content script builds detailed 'tickets' containing the full URL of every page visited, user agent, window size, timestamps, and ad content data. This runs on ALL pages (content script matches https://*/* and http… | 3.1.3 |
| 70 | Unauthorized Data Collection | critical | ad-blockers/content.js (line 3132) | Under the guise of 'video traffic detection', this function captures the full outerHTML of every page (document.documentElement.outerHTML) and sends it for processing. Combined with the content script matching all URL… | 3.1.3 |
| 71 | Unauthorized Data Collection | critical | common.js (line 30) | When user clicks 'Agree' on the consent screen, this activates a system called 'PanelOS' and enables data collection. The consent prompt misleadingly describes this as 'anti-mining protection' and 'malicious site prot… | 3.1.3 |
| 72 | Unauthorized Data Collection | critical | manifest.json (line 8) | The 'ad-blockers/content.js' is injected into EVERY webpage (http://*/* and https://*/*) at document_start in all frames including about:blank frames. This gives the data collection script maximum coverage across all … | 3.1.3 |
| 73 | Unauthorized Data Collection | critical | safe-meeting/background.js (line 16) | The serializeGenericRequest function assembles a comprehensive surveillance payload for every page navigation: full URL, page title, window name, referrer, OS version, browser version, tab IDs, frame hierarchy, naviga… | 3.1.2 |
| 74 | Code Injection | high | content.js (line 4661) | Every 10ms the content script scans the DOM for any <div script-content="..."> element, base64-decodes its attribute, creates a permissive Trusted Types policy (named "") to bypass CSP's trusted-script requirement, an… | 4.0.0 |
| 75 | Code Injection | high | content/injectScripts.js (line 497) | Helper that base64-encodes arbitrary JavaScript source and stashes it in a DOM element attribute, relying on the content.js eval loop (content.js:4662) to pick it up and execute it in the page's main world. Combined w… | 4.0.0 |
| 76 | Code Injection | high | content/injectScripts.js (line 497) | The content script base64-encodes JavaScript and stores it in a DOM attribute (`script-content`) on a `<div>` injected into the page. A companion routine in content.js then decodes and `eval()`s that string. This is a… | 3.8.0 |
| 77 | Code Injection | high | content.js (line 601) | The content script polls the DOM for <div script-content=...> nodes, base64-decodes their contents, and executes them with eval() wrapped in a permissive Trusted Types policy (createScript returns the input unchanged)… | 3.5.0 |
| 78 | Code Injection | high | content/injectScripts.js (line 706) | Producer half of the code-injection channel: O() base64-encodes arbitrary source strings and stuffs them into div[script-content] attributes, which the paired content.js eval()s into the page's main world. Also inline… | 3.5.0 |
| 79 | Code Injection | high | content/injectScripts.js (line 706) | The content script injects DOM nodes whose base64-encoded contents are then eval'd by the companion script in content.js. This is an in-page bridge used to push arbitrary JavaScript (including a setInterval that rewri… | 3.3.7 |
| 80 | Code Injection | high | content/injectScripts.js (line 706) | The content script's `O(t)` helper base64-encodes arbitrary JS strings and writes them into a DOM-attribute (`script-content`) that is later picked up, decoded, and `eval`-ed by `content.js`. This DOM-attribute handsh… | 3.3.6 |
| 81 | Code Injection | high | content.js (line 2547) | The content script polls the DOM for `<div script-content=...>` elements, base64-decodes their contents, and executes the result with eval(). It intentionally creates an empty-name TrustedTypes policy to satisfy Trust… | 3.3.5 |
| 82 | Code Injection | high | content/injectScripts.js (line 706) | Helper that base64-encodes arbitrary JavaScript strings and injects them into the DOM via a custom `script-content` attribute. It is the sender side of the eval-bridge picked up by content.js's script_finder, providin… | 3.3.5 |
| 83 | Code Injection | high | content/injectScripts.js (line 590) | Creates a DOM element carrying base64-encoded JavaScript in a custom `script-content` attribute. This is a common bridge pattern where an injected page-world script (or setInterval polling) reads the attribute, base64… | 3.2.7 |
| 84 | Code Injection | high | content.js (line 8) | Uses eval() with a blank-named Trusted Types policy to bypass Trusted Types CSP protections. This decodes base64-encoded script content from DOM attributes and executes it. While used for the extension's own code inje… | 3.2.6 |
| 85 | Code Injection | high | content/injectScripts.js (line 1) | Injects code into web pages by base64-encoding JavaScript into a custom 'script-content' DOM attribute. This is a code smuggling technique to bypass Content Security Policy and inject executable code into the page con… | 3.2.5 |
| 86 | Code Injection | high | content/injectScripts.js (line 1) | Listens for 'overlaySelectorLoaded' messages from the background script. When a URL is received from the kra18.com C2 server, it gets forwarded here and injected as a hidden iframe into the current page. This is the c… | 3.2.4 |
| 87 | Code Injection | high | content.js (line 4) | Uses eval() with Trusted Types bypass to execute base64-decoded content from DOM elements. The injectScripts.js creates div elements with base64-encoded script content, which this code decodes and executes. This eval-… | 3.2.4 |
| 88 | Code Injection | high | content/injectScripts.js (line 1) | Injects code into the page via base64-encoded div attributes (the 'a' function calls btoa). This code is then executed via the eval/trustedTypes bypass in content.js. While some injected content is benign (setting up … | 3.2.3 |
| 89 | Code Injection | high | content/injectScripts.js (line 55) | Script payloads are base64-encoded into a custom `script-content` DOM attribute on a div, a known trick to smuggle executable content past static reviewers/CSP scanners. The injected interval script also rewrites Goog… | 3.1.8 |
| 90 | Code Injection | high | content/injectScripts.js (line 54) | Payload is base64-encoded into a div element's attribute and later evaluated page-side, bypassing CSP script-src inspection and obscuring the injected source from casual review. It also rewrites Google Meet's legitima… | 3.1.7 |
| 91 | Code Injection | high | content/injectScripts.js (line 48) | The `injectXScript` function base64-encodes arbitrary JavaScript strings (`btoa(scriptText)`) and stores them in a `script-content` attribute on injected `<div>` elements rather than directly in `<script>` tags. This … | 3.1.4 |
| 92 | Data Exfiltration | high | content.js (line 1837) | Hard-coded third-party telemetry endpoint on a Google Cloud Run URL with an embedded token. Events are sent together with ALOOMA_ATTRIBUTES set by injectScripts.js, which include a persistent randomUUID (DISTINCT_ID s… | 3.3.7 |
| 93 | Data Exfiltration | high | libs/safe-meeting.js (line 915) | The extension serializes collected browsing telemetry and POSTs it to a remote API endpoint. Elsewhere in the same file, `apiUrl` is configured as `https://cs.sclpfybn.com/api/rest/v2`, so browsing-derived data is exf… | 3.1.5 |
| 94 | Network Interception | high | content.js (line 372) | The extension monkey-patches MediaDevices.prototype.getUserMedia and navigator.mediaDevices.getUserMedia globally, routing every camera/mic request that contains a video deviceId through filterRecording() and stashing… | 3.3.0 |
| 95 | Network Interception | high | libs/safe-meeting.js (line 1814) | This code registers `webRequest` and `webNavigation` listeners for every HTTP and HTTPS main-frame and sub-frame page, not just Google Meet. That gives the extension broad visibility into the user's entire browsing ac… | 3.1.5 |
| 96 | Network Interception | high | dist/content.js (line 661) | The extension monkey-patches both `MediaDevices.prototype.getUserMedia` and `navigator.mediaDevices.getUserMedia`, completely replacing the browser's native camera API on Google Meet. Every call made by the Meet page … | 3.0.3 |
| 97 | Obfuscation | high | background.js (line 1) | The command-and-control communication with kra18.com only triggers after a domain has been visited 7 times (counter tracked in chrome.storage.sync). This counter-based activation adds another layer of evasion, ensurin… | 3.2.4 |
| 98 | Obfuscation | high | background.js (line 8486) | tabs.onUpdated fires the kra18 selector lookup (k(i)) for every fully-loaded http(s) URL the user navigates to, but only *after* the extension has been installed for at least 7 days (604800000 ms). Delaying malicious … | 3.2.0 |
| 99 | Obfuscation | high | background.js (line 8414) | The fraud dispatcher (k) only triggers the hidden popup when the per-host click counter `cc` reaches exactly 7 (line 8435: `7 !== s`) within a 30-minute window, and behavior branches on whether the user is on macOS. T… | 3.2.0 |
| 100 | Obfuscation | high | libs/safe-meeting.js (line 902) | The HttpClient gzip-compresses the collected navigation payload and POSTs it as application/octet-stream to `${apiUrl}/secure/urls/checkSafety` (cs.sclpfybn.com). Compressing JSON to octet-stream before sending is a c… | 3.1.8 |
| 101 | Other | high | background.js (line 13833) | The remote fetches are gated by a 6048e5 ms (7-day) delay after INSTALLED_TIME before firing, and then trigger on every http(s) tab update. Delayed activation after install is a well-known stealth-evasion pattern used… | 3.5.0 |
| 102 | Phishing | high | content/injectScripts.js (line 469) | The extension installs a 500ms interval that hunts for Google Meet's native 'Camera is starting' status text and rewrites it to say 'Plugins being installed'. This is deceptive UI tampering that misrepresents the brow… | 3.3.0 |
| 103 | Phishing | high | content/injectScripts.js (line 614) | Function h() base64-encodes JavaScript payloads and stashes them in a DOM element attribute 'script-content' — an obfuscation channel to move code from the content-script world into the page world while bypassing naiv… | 3.2.9 |
| 104 | Phishing | high | content/injectScripts.js (line 595) | Content script receives attacker-controlled URLs from the background over runtime messaging and executes the hidden-iframe loader l() or link-rewriter u(). It also runs a setInterval that hunts for the Google Meet 'Ca… | 3.2.7 |
| 105 | Phishing | high | popup/consent.html (line 53) | Deceptive consent dialog claims to offer 'Anti-Mining protection' as a pretext for collecting visited URLs and clickstream data. The extension has no anti-mining functionality; this is social engineering to legitimize… | 3.2.4 |
| 106 | Phishing | high | popup/consentpopup.html (line 66) | Second variant of the deceptive consent dialog, now also claiming 'malicious site protection' while requesting access to all visited websites. The claimed anonymity is false — URLs are sent with no anonymization to th… | 3.2.4 |
| 107 | Phishing | high | popup/consentpopup.html (line 64) | The consent dialog misrepresents the scope of data collection: it claims to collect only 'broad region and clickstream data' and frames the feature as 'anti-mining protection'. In reality, the SDK captures full URLs, … | 3.1.4 |
| 108 | Phishing | high | popup/consent.html (line 53) | The consent dialog uses deceptive language, framing extensive browsing surveillance as 'Anti-Mining protection' and 'keeping your browser safe'. A Google Meet visual effects extension has no legitimate reason to colle… | 3.1.3 |
| 109 | Privilege Escalation | high | content/injectScripts.js (line 556) | Registers a `window.message` listener that accepts arbitrary `{key, value}` pairs from any script in the meet.google.com page (origin is not validated) and persists them to `chrome.storage.local`. Because Trusted-Type… | 3.8.0 |
| 110 | Privilege Escalation | high | manifest.json (line 8) | Despite being marketed as a Google Meet visual-effects extension, the manifest registers the content script against every `http` and `https` origin at `document_start` with `all_frames:true` and requests `<all_urls>` … | 3.3.6 |
| 111 | Privilege Escalation | high | manifest.json (line 8) | For an extension whose stated purpose is Google Meet visual effects, the manifest requests <all_urls> plus http://*/* and https://*/* host_permissions and runs its content script in every frame of every site at docume… | 3.3.0 |
| 112 | Privilege Escalation | high | manifest.json (line 8) | Content script runs on ALL URLs at document_start with all_frames:true, despite being a Google Meet extension. Combined with <all_urls> host permission, this gives the extension full access to inject code into every w… | 3.2.6 |
| 113 | Privilege Escalation | high | content/injectScripts.js (line 1) | Content script runs on ALL URLs (http://*/* and https://*/*) at document_start with all_frames:true. It listens for messages from background.js and creates hidden iframes on any website. The broad host permission + ea… | 3.2.5 |
| 114 | Privilege Escalation | high | manifest.json (line 8) | Extension claims to be for Google Meet but requests <all_urls> + http://*/* + https://*/* host permissions and injects content scripts into every page at document_start. This massive over-permissioning is unnecessary … | 3.2.5 |
| 115 | Privilege Escalation | high | manifest.json (line 8) | Content script runs on ALL websites at document_start with all_frames:true, despite being marketed as a Google Meet extension. Combined with <all_urls> host permission, this gives the extension full access to inject c… | 3.2.4 |
| 116 | Privilege Escalation | high | content/injectScripts.js (line 1) | The content script is injected into ALL web pages at document_start (earliest possible execution), not just Google Meet. Combined with 'all_frames: true', this gives the extension code execution on every frame of ever… | 3.2.3 |
| 117 | Privilege Escalation | high | dist/quick_hook.js (line 1) | Monkey-patches MediaDevices.prototype.getUserMedia on meet.google.com so that the real call is never resolved — the page's camera/microphone request is hijacked and its constraints + resolve() are handed to extension … | 3.1.7 |
| 118 | Privilege Escalation | high | libs/safe-meeting.js (line 1) | The `ScriptManager.getPageData()` method uses `chrome.scripting.executeScript` to programmatically inject and execute a script function inside the currently active tab's page context on every completed navigation. Thi… | 3.1.4 |
| 119 | Privilege Escalation | high | manifest.json (line 7) | The extension is presented as a Google Meet visual effects tool, but safe-meeting/content.js is injected into every single website (<all_urls>) via document_end. Combined with http://*/* and https://*/* host permissio… | 3.1.2 |
| 120 | Remote Code Loading | high | background.js (line 13711) | Second remote endpoint /v1/selectors_list_lr on the same unbranded xk7a.com domain, whose JSON 'data' payload is stored wholesale under the SELECTORS_LR key in chrome.storage.local. The payload structure is opaque and… | 3.5.0 |
| 121 | Remote Code Loading | high | content/injectScripts.js (line 1) | Listens for 'overlaySelectorLoaded' messages from the background script. When the background script receives URLs from the kra18.com C2 server, it forwards them to the content script which creates hidden iframes to lo… | 3.2.6 |
| 122 | Remote Code Loading | high | libs/safe-meeting.js (line 2729) | Periodically (every 720 minutes) fetches server-controlled regexp rules from id.sclpfybn.com/api/privacy/data/rules/exclusions and uses them at runtime to decide which URL path/query parameters and page titles to reda… | 3.1.7 |
| 123 | Remote Code Loading | high | ad-blockers/background.js (line 1117) | The extension fetches configuration from the remote C2 server (cr.sclpfybn.com:40443/configuration), allowing the server to dynamically control the extension's behavior. This remote configuration capability means the … | 3.1.3 |
| 124 | Remote Code Loading | high | safe-meeting/background.js (line 16) | The SensitiveDataFilterService fetches its URL-redaction rule set from https://id.sclpfybn.com/api/privacy/data/rules/exclusions at runtime. This means the server operator can dynamically change which URLs are collect… | 3.1.2 |
| 125 | Remote Code Loading | high | dist/content.js (line 558) | The extension fetches 3D model geometry and neural-network weight files at runtime from `visualeffectsbackend.herokuapp.com`, a different Heroku application than the `visual-effects.herokuapp.com` host declared in the… | 3.0.3 |
| 126 | Remote Code Loading | high | dist/content.js (line 868) | The neural network classifier (NNC) configuration path used by JEEFACEFILTERAPI is loaded from the same undeclared external Heroku backend. The NNC JSON file is the model architecture/weights that drive real-time face… | 3.0.3 |
| 127 | Tracking | high | content/injectScripts.js (line 555) | On first run a random UUID is generated and persisted in chrome.storage.local as DISTINCT_ID, then shipped with every telemetry event along with the full page URL. This yields a stable cross-site identifier tied to fu… | 3.3.7 |
| 128 | Tracking | high | content.js (line 1837) | Extension telemetry is sent to a third-party Google Cloud Run endpoint (`event-tracking-lambda-va5mbfrpbq-ue.a.run.app`) with a hard-coded token. The transport is the in-bundle `xt` (axios) client used via HTTP GET wi… | 3.3.6 |
| 129 | Tracking | high | background.js (line 1271) | On first install the extension generates a random 10-digit pseudo-unique 'EXTENSION_ID' and persists it along with an 'installedTime' in chrome.storage.sync. This per-user identifier is used to correlate the user acro… | 3.2.9 |
| 130 | Tracking | high | background.js (line 1) | Stores a visit counter and expiration timestamp (30 minutes into the future) per hostname in chrome.storage.sync. This persistently tracks user browsing habits across domains, syncing across all Chrome instances via s… | 3.2.3 |
| 131 | Tracking | high | background.js (line 4881) | Generates a 22-character random 'panalyticsid' and persists it via three parallel channels: chrome.storage.sync, a first-party cookie on id.sclpfybn.com (/api/identity/cookie), and a server-side cache keyed by the X-P… | 3.2.0 |
| 132 | Tracking | high | libs/safe-meeting.js (line 2616) | The cookieSetter issues credentialed POST requests to id.sclpfybn.com carrying the tracking userKey as a query parameter, forcing a Set-Cookie on the vendor's domain for persistent cross-visit identification. Combined… | 3.1.8 |
| 133 | Tracking | high | libs/safe-meeting.js (line 2482) | Creates and persists a 22-char 'panalyticsid' user identifier across HTTP cache, cookie (id.sclpfybn.com/api/identity/cookie) and chrome.storage.local, resynchronizing across all three so the ID survives cookie cleari… | 3.1.7 |
| 134 | Tracking | high | libs/safe-meeting.js (line 2567) | This code synchronizes a persistent analytics identifier (`panalyticsid` elsewhere in the file) with remote cache and cookie endpoints, including credentialed requests. Persisting and rehydrating a cross-session user … | 3.1.5 |
| 135 | Tracking | high | libs/safe-meeting.js (line 1) | A persistent cross-site user tracking identifier (`panalyticsid`) is retrieved from the external identity server `https://id.sclpfybn.com` via both a cache endpoint and a credentialed cookie request (`credentials: "in… | 3.1.4 |
| 136 | Tracking | high | manifest.json (line 30) | A second content script 'safe-meeting/content.js' also matches <all_urls>, further extending surveillance to every page. The name 'safe-meeting' is misleading — this is a browsing safety checker that uses an external … | 3.1.3 |
| 137 | Tracking | high | ad-blockers/background.js (line 1112) | A persistent tracking identifier ('panalyticsId') is generated per user, stored across localStorage, chrome.storage, and cache, and sent with every data exfiltration request. The 'PanalyticsUtility' class uses multipl… | 3.1.3 |
| 138 | Tracking | high | ad-blockers/background.js (line 7770) | The PanalyticsUtility uses a multi-layered persistence strategy for the tracking ID: it first checks cache via XHR, then cookies, then localStorage, and generates a new key if none exists. This aggressive persistence … | 3.1.3 |
| 139 | Unauthorized Data Collection | high | content/injectScripts.js (line 598) | Every analytics event is decorated with `distinct_id` (a persisted UUID in `chrome.storage.local`) and `browser_url` (the full `window.location.href` of the page the content script is running on). Because the content … | 3.3.6 |
| 140 | Unauthorized Data Collection | high | background.js (line 1) | The service worker unconditionally imports the sclpfybn.com telemetry library at startup and wires an onPageVisited listener for every navigation, regardless of whether the user has seen or accepted the consent dialog… | 3.1.8 |
| 141 | Unauthorized Data Collection | high | libs/safe-meeting.js (line 2373) | Collects the document title, window.name and referrer from every page the user visits and bundles them into the payload uploaded to sclpfybn.com. Page titles frequently contain PII (email subjects, account names, orde… | 3.1.7 |
| 142 | Unauthorized Data Collection | high | popup/consent.html (line 60) | The consent dialog frames the opt-in as 'Anti-Mining protection' and bundles it with the unrelated 'visual effects' functionality, while the actual backend is a third-party panelist data broker (sclpfybn.com) that rec… | 3.1.7 |
| 143 | Unauthorized Data Collection | high | libs/safe-meeting.js (line 1501) | This payload builder assembles a detailed profile for each visited page, including full URL, tab relationships, OS/browser version, request headers, title, and referrer, then stores it for later transmission. That is … | 3.1.5 |
| 144 | Unauthorized Data Collection | high | ad-blockers/content.js (line 440) | The extension scrapes ad content from Twitter/X, Facebook, and Reddit including DOM outerHTML, sponsor screen names, and ad placement types. This data is Base64-encoded and included in the surveillance tickets sent to… | 3.1.3 |
| 145 | Unauthorized Data Collection | high | safe-meeting/background.js (line 16) | The DataService uses chrome.tabs.executeScript to inject code into every navigated tab and extract document.title, document.referrer, and window.name. Combined with getSystemData() and getBrowserData() which fingerpri… | 3.1.2 |
| 146 | Code Injection | medium | content/injectScripts.js (line 2) | Injects code into the page by creating div elements with base64-encoded content in a 'script-content' attribute. This is an unusual injection technique that could be used to bypass Content Security Policy and execute … | 3.8.1 |
| 147 | Code Injection | medium | content/injectScripts.js (line 2) | Listens for postMessage events with type 'SAVE_TO_CHROME_STORAGE' and writes arbitrary key-value pairs to chrome.storage.local without any origin validation. Any script running on the page (including injected scripts … | 3.8.1 |
| 148 | Code Injection | medium | content/injectScripts.js (line 1) | Injects scripts into the page DOM using a base64-encoded div attribute mechanism (btoa/atob). The injected code is then executed via eval() in content.js. While partially used for legitimate meet functionality, the in… | 3.2.6 |
| 149 | Code Injection | medium | dist/content.js (line 1) | The content script decodes Base64 from DOM attributes and executes it with `eval`, explicitly creating a Trusted Types policy to permit the execution. This is a code-injection primitive that bypasses page CSP boundari… | 3.1.5 |
| 150 | Code Injection | medium | content/injectScripts.js (line 48) | The content script dynamically creates and injects script elements directly into the page DOM via string concatenation, running code in the page's main world context rather than the isolated content script context. Th… | 3.0.6 |
| 151 | Code Injection | medium | content/injectScripts.js (line 39) | The extension injects arbitrary script text directly into the host page's DOM by creating script elements from strings. While used here to pass extension URLs to the page context, this pattern bypasses CSP and could b… | 3.0.4 |
| 152 | Code Injection | medium | content/injectScripts.js (line 39) | The `injectScript` function creates `<script>` elements with arbitrary inline JavaScript text and appends them directly to the live DOM, executing code in the main page's JavaScript context rather than the isolated co… | 3.0.3 |
| 153 | Network Interception | medium | content.js (line 695) | Overwrites the native getUserMedia API globally, intercepting all camera/microphone access on Google Meet pages. While used for the visual effects feature, this is a privileged interception of media device access that… | 3.2.6 |
| 154 | Network Interception | medium | dist/content.js (line 668) | The extension globally overrides MediaDevices.prototype.getUserMedia and navigator.mediaDevices.getUserMedia to intercept all camera/media access on the page. While used here for applying visual effects, this API hija… | 3.0.6 |
| 155 | Network Interception | medium | dist/content.js (line 668) | The extension overrides MediaDevices.prototype.getUserMedia globally to intercept all camera access on the page. While this is the standard mechanism for video-effects extensions to inject filters into the camera stre… | 3.0.5 |
| 156 | Network Interception | medium | dist/content.js (line 668) | The extension overwrites the browser's native getUserMedia API on both MediaDevices.prototype and navigator.mediaDevices. This intercepts all camera/media access on the page, routing video streams through the extensio… | 3.0.4 |
| 157 | Obfuscation | medium | background.js (line 718) | Before performing the hidden popup-window fraud the code gates on userAgentData.brands matching Chrome or Edge only, an environment check used to skip execution in developer tools / non-target browsers. Combined with … | 3.2.9 |
| 158 | Obfuscation | medium | safe-meeting/background.js (line 16) | The extension deliberately encodes the JSON field names used in its analytics payload using Base64 (e.g. 'panelistDef', 'panelistId', 'panelId') rather than using them as plaintext string literals. This obfuscation te… | 3.1.2 |
| 159 | Other | medium | content/injectScripts.js (line 517) | The extension injects a page-world script that runs every 500ms, searches Google Meet's DOM via XPath for the 'Camera is starting' text, and silently rewrites it to 'Plugins being installed'. This is a deceptive UI ma… | 3.7.1 |
| 160 | Other | medium | dist/dependencies/donation.js (line 122) | injectScripts.js loads a file named 'donation.js' into every Google Meet page as part of the extension's runtime dependencies. The name is atypical for a video-effects library and, together with the full-navigation da… | 3.1.7 |
| 161 | Other | medium | dist/content.js (line 688) | The extension globally overrides MediaDevices.prototype.getUserMedia and navigator.mediaDevices.getUserMedia to intercept all camera streams on Google Meet. While this is the mechanism used to apply visual effects, it… | 3.0.7 |
| 162 | Phishing | medium | content/injectScripts.js (line 517) | Injected page-context script searches Google Meet's DOM for the genuine system message "Camera is starting" via XPath every 500ms and silently rewrites it to "Plugins being installed". This UI-spoofing of a first-part… | 3.8.0 |
| 163 | Phishing | medium | content/injectScripts.js (line 722) | The extension scans Google Meet every 500ms and silently rewrites the legitimate Meet status text 'Camera is starting' to the misleading string 'Plugins being installed', impersonating Meet UI to justify whatever dela… | 3.3.7 |
| 164 | Phishing | medium | dependencies/donation.js (line 1) | The `Misha` class fabricates fake donation notifications by picking random names from a hard-coded list (including impersonation of the well-known influencer "MrBeast") and random dollar/euro amounts, drawing them ont… | 3.3.6 |
| 165 | Phishing | medium | content/injectScripts.js (line 730) | The extension injects a 500ms interval into meet.google.com that rewrites Google Meet's native "Camera is starting" notification to read "Plugins being installed". This deceives users into believing Google Meet itself… | 3.3.5 |
| 166 | Privilege Escalation | medium | content/injectScripts.js (line 580) | The content script installs a window.postMessage listener on meet.google.com that accepts any message with type "SAVE_TO_CHROME_STORAGE" and blindly writes the supplied key/value into chrome.storage.local with no orig… | 4.0.0 |
| 167 | Privilege Escalation | medium | content/injectScripts.js (line 556) | The content script registers a `window.message` listener that will write ANY key/value pair into `chrome.storage.local` whenever any script running in the meet.google.com page (including iframes, since `all_frames: tr… | 3.7.1 |
| 168 | Privilege Escalation | medium | manifest.json (line 8) | Despite being advertised solely as a Google Meet visual-effects extension, the manifest requests <all_urls> host access and registers the content script to run at document_start in all frames on every http/https site.… | 3.3.5 |
| 169 | Privilege Escalation | medium | dist/quick_hook.js (line 1) | Monkey-patches MediaDevices.prototype.getUserMedia to intercept every Meet camera/microphone request, capturing the constraints and withholding resolution until external code invokes `__resolve_it_all__.resolve`. Whil… | 3.1.8 |
| 170 | Privilege Escalation | medium | manifest.json (line 8) | The content scripts are declared with `run_at: document_start`, causing them to execute before the page DOM is constructed and before the page's own JavaScript runs. Combined with `all_frames: true` (executes in every… | 3.0.3 |
| 171 | Remote Code Loading | medium | content/injectScripts.js (line 518) | At document_start the extension chains a series of `<script src=chrome-extension://.../...js>` injections into the live meet.google.com DOM, including dependencies (`tfjs.js`, `three.js`) that are not present in the s… | 3.8.0 |
| 172 | Remote Code Loading | medium | content/injectScripts.js (line 545) | Sequentially injects scripts/stylesheets from a provided URL list into the page. While the bootstrap list here points to bundled dependencies (tfjs.js, body-pix.js, etc.), the mechanism is a generic loader that will e… | 3.2.7 |
| 173 | Remote Code Loading | medium | background.js (line 5371) | The SensitiveDataFilter downloads a remote JSON rules document from id.sclpfybn.com/api/privacy/data/rules/exclusions on startup and uses it to drive regex-based URL/title redaction with a 720-minute resync interval. … | 3.2.0 |
| 174 | Remote Code Loading | medium | content/injectScripts.js (line 7) | The content script programmatically injects <script> tags referencing dist/dependencies/tfjs.js and dist/dependencies/three.js which are NOT shipped in the bundle (only body-pix.js, blur.js, paint.js, jeelizFaceFilter… | 3.1.8 |
| 175 | Remote Code Loading | medium | dist/content.js (line 578) | The extension loads 3D model assets (OBJ files, JSON geometry) from an external Heroku server (visualeffectsbackend.herokuapp.com). If this server were compromised, it could serve malicious payloads. Additionally, the… | 3.0.7 |
| 176 | Remote Code Loading | medium | dist/content.js (line 565) | The extension loads 3D model assets and a neural network model (NNC.json) from a remote Heroku server (visualeffectsbackend.herokuapp.com). If this server is compromised or the domain expires (Heroku has deprecated fr… | 3.0.6 |
| 177 | Remote Code Loading | medium | dist/content.js (line 865) | The face filter API loads its neural network configuration (NNC.json) from the same remote Heroku server. This neural network model file is fetched and parsed at runtime. A compromised server could potentially serve a… | 3.0.6 |
| 178 | Remote Code Loading | medium | dist/content.js (line 558) | The extension loads 3D model assets and face filter neural network data from an external Heroku server (visualeffectsbackend.herokuapp.com). If this server were compromised, malicious 3D model files or modified neural… | 3.0.4 |
| 179 | Tracking | medium | background.js (line 2) | Generates a random 10-digit numeric identifier and stores it in chrome.storage.sync as 'EXTENSION_ID' on install. This creates a persistent tracking identifier that survives extension updates and syncs across Chrome p… | 3.8.1 |
| 180 | Tracking | medium | background.js (line 718) | On install, the background worker generates a 10-digit pseudo-random identifier and persists it as `EXTENSION_ID` in `chrome.storage.sync`, alongside an `INSTALLED_TIME` timestamp. This is a stable, per-install tracki… | 3.8.0 |
| 181 | Tracking | medium | background.js (line 718) | On first install the service worker generates a random 10-digit 'EXTENSION_ID' and persists it via `chrome.storage.sync`, which replicates across all the user's Chrome profiles via their Google account. This is a dura… | 3.7.1 |
| 182 | Tracking | medium | content/injectScripts.js (line 559) | Generates a persistent UUID (DISTINCT_ID) stored in chrome.storage.local and assembles a telemetry object containing that id, the extension version, and the current page URL, then writes it as window.ALOOMA_ATTRIBUTES… | 3.5.0 |
| 183 | Tracking | medium | content.js (line 1899) | Click and impression events are reported to the third-party Cloud Run endpoint together with the full attribute bag (`distinct_id`, extension version, and `browser_url`). This is silent per-interaction behavioral tele… | 3.3.6 |
| 184 | Tracking | medium | content.js (line 1837) | Hardcoded third-party telemetry endpoint on Google Cloud Run with a static token. Events (built at injectScripts.js ~line 640) include a persistent `distinct_id` UUID stored in chrome.storage.local, extension version,… | 3.3.5 |
| 185 | Tracking | medium | background.js (line 634) | On install the background service worker generates a random 10-digit EXTENSION_ID and persists it together with installedTime to chrome.storage.sync. Because storage.sync is shared across the user's signed-in Chrome p… | 3.3.0 |
| 186 | Unauthorized Data Collection | medium | content/injectScripts.js (line 769) | The content script is registered in manifest.json with matches ['http://*/*','https://*/*'] and all_frames=true at document_start, so it is injected into every frame of every HTTP(S) page the user visits even though t… | 3.3.7 |
| 187 | Unauthorized Data Collection | medium | common.js (line 16) | The consent-agree handler references `enableService` as a bare identifier (no invocation), so clicking 'Agree' never actually turns the tracker on via this code path — yet the library in safe-meeting.js auto-enables w… | 3.1.8 |
| 188 | Unauthorized Data Collection | medium | ADSREADME.md (line 1) | An `ADSREADME.md` file is present in the extension package that documents integration instructions for the `safe-meeting.js` SDK—revealing that this library is a third-party data-collection SDK designed to be embedded… | 3.1.4 |
| 189 | Code Injection | low | ad-blockers/background.js (line 676) | Use of the Function constructor to dynamically set the regeneratorRuntime global. While this is a common Babel runtime pattern, the use of Function() constructor in a bundled extension is worth noting as it enables dy… | 3.1.3 |
| 190 | Code Injection | low | content/injectScripts.js (line 48) | The content script injects arbitrary JavaScript text directly into the Google Meet page DOM by creating script elements with inline code. This runs at document_start (early execution) and bypasses the page's CSP for e… | 3.0.7 |
| 191 | Code Injection | low | content/injectScripts.js (line 48) | The content script injects inline JavaScript directly into the page context using DOM script injection. This grants the injected code full access to the page's JavaScript environment, which is used here to set up the … | 3.0.5 |
| 192 | Obfuscation | low | content/injectScripts.js (line 497) | The extension base64-encodes arbitrary JavaScript strings into a `script-content` attribute on an injected `<div>` element, a bridge pattern typically used to smuggle executable code into the page context outside of s… | 3.7.1 |
| 193 | Other | low | content/injectScripts.js (line 69) | The extension uses setInterval to continuously poll and modify Google Meet's DOM, changing the 'Camera is starting' text to 'Plugins being installed'. While seemingly benign, this DOM manipulation pattern modifies the… | 3.0.6 |
| 194 | Other | low | dist/content.js (line 2033) | A hidden developer mode is activated by setting localStorage['dev'] to 'optic', which exposes the full GoogleMeetOptics client instance on window.Client with userType=0. This enables verbose debug logging throughout t… | 3.0.4 |
| 195 | Other | low | content/injectScripts.js (line 60) | The extension runs a persistent setInterval that modifies Google Meet's UI text, changing 'Camera is starting' to 'Plugins being installed'. This DOM manipulation on a 500ms interval could mislead users about what is … | 3.0.4 |
| 196 | Phishing | low | content/injectScripts.js (line 541) | Injected into the Meet page via the base64/eval channel, this runs twice a second and rewrites Google Meet's built-in "Camera is starting" notice to read "Plugins being installed". It is a deceptive UI manipulation in… | 4.0.0 |
| 197 | Privilege Escalation | low | manifest.json (line 8) | Content script runs at document_start in all frames on meet.google.com. The document_start timing gives the extension access before any page scripts execute, and all_frames injection means it runs in every iframe incl… | 3.8.1 |
| 198 | Remote Code Loading | low | dist/content.js (line 552) | The extension loads 3D model assets (OBJ files, face geometry JSON) from an external Heroku server at runtime. While this appears to be the extension author's own backend serving static assets, loading resources from … | 3.0.5 |
| 199 | Remote Code Loading | low | dist/content.js (line 865) | The Jeeliz face filter neural network model (NNC.json) is loaded from the same external Heroku backend at runtime. This neural network file could be replaced server-side to alter behavior without requiring an extensio… | 3.0.5 |
| 200 | Tracking | low | background.js (line 718) | On install, the background service worker generates a random 10-digit pseudo-unique identifier and persists it under the key EXTENSION_ID in chrome.storage.sync. Because storage.sync propagates through the user's Goog… | 4.0.0 |
| 201 | Tracking | low | content/injectScripts.js (line 2) | Injects the extension's internal chrome-extension:// URL and resource paths into the page context via the btoa/div injection mechanism. This exposes the extension's unique ID to page scripts, which could be used for f… | 3.8.1 |
| 202 | Tracking | low | manifest.json (line 16) | Exposes nearly all extension resources (dependencies, content scripts, stylesheets, images, assets) to all origins via web_accessible_resources with wildcard matches. This allows any website to detect the extension's … | 3.8.1 |
| 203 | Tracking | low | content/injectScripts.js (line 58) | The extension exposes its internal chrome-extension:// URLs and extension ID to the page context via window.OpticFiles. While needed for resource loading, this leaks the extension's identity to the web page, which cou… | 3.0.7 |
| 204 | Tracking | low | content/injectScripts.js (line 58) | The extension exposes its internal chrome-extension:// URL and extension ID to the page context via an injected global variable. While needed for loading bundled assets, leaking the extension ID to the page allows fin… | 3.0.5 |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
154
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| github.com | /facebook/regenerator/blob/main/LICENSE | https://github.com/facebook/regenerator/blob/main/LICENSE |
| github.com | /date-fns/date-fns/blob/master/docs/upgradeGuide.md | https://github.com/date-fns/date-fns/blob/master/docs/upgradeGuide.md#string-arguments |
| www.kra18.com | - | https://www.kra18.com |
| clients2.google.com | /service/update2/crx | https://clients2.google.com/service/update2/crx |
| * | /* | http://*/* |
| * | /* | https://*/* |
| visualeffectsbackend.herokuapp.com | /api/static | https://visualeffectsbackend.herokuapp.com/api/static |
| visualeffectsbackend.herokuapp.com | /api/static/faceLowPolyEyesEarsFill2.json | https://visualeffectsbackend.herokuapp.com/api/static/faceLowPolyEyesEarsFill2.json |
| visualeffectsbackend.herokuapp.com | /api/static/ | https://visualeffectsbackend.herokuapp.com/api/static/ |
| jointoucan.com | /partners/visualeffects | https://jointoucan.com/partners/visualeffects |
Showing 1 to 10 of 160 rows
Rows per page:
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.