Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Google Optimize

CRITICAL RISKRemoved from Chrome Web Store

Google Optimize

ID: bhdplaindhdkiflmbfbciehdccfhegci

Could be malicious

Supported Languages

🇧🇬Bulgarian

🇪🇸Catalan

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇳🇴Norwegian

🇵🇱Polish

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.44.2

Size

0.13 MB

Rating

4.3/5

Reviews

Users

537,465

Type

Extension

Updated

Jan 27, 2022

Publisher Contextual Analysis

Author: https://optimize.google.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

537,465

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Facilitates editing content with Google Optimize.

The Optimize extension helps you test and personalize your site with Google Optimize. Create better site experiences with Optimize. Once the extension is downloaded, use our visual editor to change just about anything on your site – text, images, layouts and more – and then preview how these new experiences will look on various devices before launching your site experiment. Learn more about Optimize at g.co/optimize. By installing this item, you agree to use it in accordance with your applicable Optimize terms, if any. Otherwise, you agree to the Google Terms of Service and Privacy Policy at https://policies.google.com/privacy

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+0.79%(+4,210 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 67 ratings+1 (2%)

Average Rating

Current: 4.27 / 5.0-0.02

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High5

Medium6

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.44.3 Code review	5
0.44.2 Code review	8

Extension Version	Code Review Findings
0.44.3	5
0.44.2	8

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
content.js5
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	content.js (line 949)	This content script constructs a remote script URL from runtime-supplied parameters and injects it into the page context on arbitrary sites. Because the extension runs on all HTTP/HTTPS pages, this is effectively remo…	0.44.3
2	Remote Code Loading	critical	content.js (line 38)	When a token is present, the content script constructs a remote script URL by concatenating a `host` value (retrieved from chrome.storage, originally supplied via an external message from optimize.google.com) with `/o…	0.44.2
3	Network Interception	high	background.js (line 21)	A blocking `onBeforeSendHeaders` listener is registered against `<all_urls>` for the active tab. It intercepts every outgoing HTTP/HTTPS request and rewrites the `User-Agent` header before the request is sent. Running…	0.44.2
4	Network Interception	high	background.js (line 19)	A blocking `onBeforeRequest` listener intercepts all script loads matching `optimize.js` or `gtm/js` URLs and redirects them by appending authentication and experiment parameters (`gtm_auth`, `gtm_preview`, `gtm_exper…	0.44.2
5	Privilege Escalation	high	background.js (line 20)	The extension uses the `chrome.debugger` API to attach to arbitrary browser tabs and send Chrome DevTools Protocol commands including `Network.enable` (full network traffic visibility), `Network.setUserAgentOverride` …	0.44.2
6	Remote Code Loading	high	background.js (line 1272)	The extension accepts externally supplied `host`, `token`, `modelUrl`, and device settings from a web page and persists them without validating the destination. In combination with the injected loader in `content.js`,…	0.44.3
7	Remote Code Loading	high	content.js (line 36)	The `ab` Soy template generates an IIFE string (injected as a `<script>` tag into the target page) that dynamically creates another script element whose `src` is the remote inject URL with auth token and user credenti…	0.44.2
8	Network Interception	medium	background.js (line 737)	This blocking `webRequest` handler rewrites matching script requests by appending preview, auth, experiment, and debug parameters. It is a clear network interception pattern that alters page resource loading behavior …	0.44.3
9	Network Interception	medium	background.js (line 792)	This code installs a blocking header-rewrite hook on `<all_urls>` and replaces the `User-Agent` header for the target tab. Modifying request headers across arbitrary destinations is a powerful interception capability …	0.44.3
10	Other	medium	content.js (line 664)	The content script directly reads and writes page cookies and manages a `__TAG_ASSISTANT` cookie from a script injected into every page at `document_start`. While this appears tied to preview state, cookie manipulatio…	0.44.3
11	Other	medium	content.js (line 37)	The `bb` template generates a script that overrides `window.navigator.userAgent` via `Object.defineProperty` and this script is injected into the `<head>` of every iframe when the editor tab is active. Spoofing the Us…	0.44.2
12	Other	medium	background.js (line 41)	The external message handler (reachable from `https://optimize.google.com/optimize/*`) accepts a `"set"` command that stores a `host`, `token`, `modelUrl`, and `authUser` into chrome.storage and immediately activates …	0.44.2
13	Unauthorized Data Collection	medium	manifest.json (line 9)	The content script runs at `document_start` in every frame on every HTTP/HTTPS page. Combined with the `debugger`, `webRequestBlocking`, and broad host permissions, the extension has the capability to observe and modi…	0.44.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


support.google.com	/optimize/answer/7388531	https://support.google.com/optimize/answer/7388531
www.about.to.redirect.com	-	http://www.about.to.redirect.com/
redirect.result.com	-	http://redirect.result.com/
www.google.com	-	https://www.google.com/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	http://*/
*	-	https://*/
*	/*	http:///
*	/*	https:///
optimize.google.com	/optimize/*	https://optimize.google.com/optimize/*

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.3 out of 5 · 7 most recent reviews

Text reviews

Positive

Negative

nice

CHANEL LBT-KAYOA·23 Feb 2023

Really improved efficiency

Adrian Brown·11 Jan 2023

Espero ter bons resultados para o site riversbeaches.com

Carlos Almeida·26 Dec 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Google Optimize

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews