Security Alert: Confirmed Malware
Google Optimize
ID: bhdplaindhdkiflmbfbciehdccfhegci
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://optimize.google.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Facilitates editing content with Google Optimize.
The Optimize extension helps you test and personalize your site with Google Optimize. Create better site experiences with Optimize. Once the extension is downloaded, use our visual editor to change just about anything on your site – text, images, layouts and more – and then preview how these new experiences will look on various devices before launching your site experiment. Learn more about Optimize at g.co/optimize. By installing this item, you agree to use it in accordance with your applicable Optimize terms, if any. Otherwise, you agree to the Google Terms of Service and Privacy Policy at https://policies.google.com/privacy
When a token is present, the content script constructs a remote script URL by concatenating a `host` value (retrieved from chrome.storage, originally supplied via an external message from optimize.google.com) with `/optimize/inject/inject.js`, then injects a `<script>` element pointing to that URL into the current page's `<head>`. This gives the remote server the ability to execute arbitrary JavaScript in the context of any page the user visits while the editor is active. Although constrained to the Google Optimize editing session, the host value is controlled by an external party and the injected script runs with full page access.
var h = e + "optimize/inject/inject.js", l = Sa(b.authUser), q = Ta(b.language);db(function() { var m = g || "", n = Za(), p = ha(); p && n.setAttribute("nonce", p); a.R(n, ab, { N: h, U: "goptedit", token: c, authUser: l, language: q, deviceType: m, L: { da: a.getMessage("internal_error"), aa: a.getMessage("failed_to_load"), Y: a.getMessage("check_network") }, nonce: p }); document.head ? document.head.appendChild(n) : document.insertBefore(n, document.body)})The `ab` Soy template generates an IIFE string (injected as a `<script>` tag into the target page) that dynamically creates another script element whose `src` is the remote inject URL with auth token and user credentials appended as query parameters. The auth token and authUser values flow from chrome.storage directly into the injected page's DOM, potentially exposing session credentials to the page's JavaScript environment and any XSS vulnerability present on the host page.
var ab = function(a) { // ... return V("\n (function() {\n var injectSrc = '" + W(b) + "?" + W(c) + "=" + W(f) + ("" + "" == e ? "" : "&authuser=" + W(e)) + ("" + "" == d ? "" : "&devicetype=" + W(d)) + ("" + "" == k ? "" : "&hl=" + W(k)) + "'; var nonce = '" + W(a) + "';\n " + "if(window['_google_opt_edit']) {\n return;\n }\n" + "window['_google_opt_edit'] = {};\n" + "var injectScript = document.createElement('script');\n" + "injectScript.type = 'text/javascript';\n" + "injectScript.src = injectSrc;\n" + "if (nonce) {\n injectScript.setAttribute('nonce', nonce);\n }\n" + "if (document.head) {\n document.head.appendChild(injectScript);\n" + "} else {\n document.insertBefore(injectScript, document.body);\n }...")The extension uses the `chrome.debugger` API to attach to arbitrary browser tabs and send Chrome DevTools Protocol commands including `Network.enable` (full network traffic visibility), `Network.setUserAgentOverride` (spoofs the browser's network-level User-Agent), and `Page.setDeviceMetricsOverride` (alters viewport geometry). CDP attachment grants near-complete control of the tab including the ability to intercept responses and read network traffic, far beyond what is strictly needed for device preview.
var qa = function(a, b, c) { if (a.runtime.lastError) alert(a.i18n.getMessage("emulation_failure", [a.runtime.lastError.message])); else { var d = { tabId: b }, e = C[c]; a.I.attach(d, "1.1", function() { a.I.sendCommand(d, "Network.enable"); a.I.sendCommand(d, "Page.enable"); a.I.sendCommand(d, "Page.setTouchEmulationEnabled", { enabled: !0 }); a.I.sendCommand(d, "Page.setDeviceMetricsOverride", { width: e.A, height: e.u, deviceScaleFactor: e.v, mobile: !0, fitWindow: !0 }); a.I.sendCommand(d, "Network.setUserAgentOverride", { userAgent: e.o }); a.I.sendCommand(d, "Page.reload", {}) }) }};A blocking `onBeforeSendHeaders` listener is registered against `<all_urls>` for the active tab. It intercepts every outgoing HTTP/HTTPS request and rewrites the `User-Agent` header before the request is sent. Running in blocking mode on all URLs means the extension acts as a full request-level man-in-the-middle for the tab, and any future change to the listener callback could trivially add header injection or request cancellation.
var ua = function(a, b, c) { ra(a); c && (a.g = sa(c), a.g && a.webRequest.onBeforeSendHeaders.addListener( a.g, { urls: ["<all_urls>"], tabId: b }, ["blocking", "requestHeaders"] )) }, ra = function(a) { a.g && a.webRequest.onBeforeSendHeaders.removeListener(a.g); a.g = null };function sa(a) { a = C[a]; if (!a) return null; var b = a.o; return b ? function(c) { if (c.requestHeaders) { for (var d = 0; d < c.requestHeaders.length; ++d) { var e = c.requestHeaders[d]; if ("user-agent" === e.name.toLowerCase()) { e.value = b; break } } return { requestHeaders: c.requestHeaders } } } : null}A blocking `onBeforeRequest` listener intercepts all script loads matching `optimize.js` or `gtm/js` URLs and redirects them by appending authentication and experiment parameters (`gtm_auth`, `gtm_preview`, `gtm_experiment`, `gtm_debug`). This silently modifies how Google Tag Manager and Optimize scripts are loaded, injecting auth credentials into third-party script requests without the page's knowledge. The redirect is opaque to the page and could be leveraged to point at attacker-controlled script variants if the stored `containerPublicId` is tampered with.
var pa = function(a, b) { a.g && a.webRequest.onBeforeRequest.removeListener(a.g); a.g = oa(a, b); a.webRequest.onBeforeRequest.addListener( a.g, { types: ["script"], urls: ["*://*/*optimize.js*", "*://*/*gtm/js*"], tabId: b.tabId }, ["blocking"] ) }, oa = function(a, b) { return function(c) { if (144E5 <= a.ca() - b.startTimeMs) a.storage.remove(["containerParams"]), D(a); else if (c.url && (-1 !== c.url.indexOf("/gtm/js?id=" + b.containerPublicId) || -1 !== c.url.indexOf("/optimize.js?id=" + b.containerPublicId))) { var d = ""; b.resourceKey && (d += ">m_preview=" + encodeURIComponent(b.resourceKey)); b.auth && (d += ">m_auth=" + encodeURIComponent(b.auth)); b.experiment && (d += ">m_experiment=" + encodeURIComponent(b.experiment)); b.debug && (d += ">m_debug=" + b.debug); if (-1 === c.url.indexOf(d)) return { redirectUrl: c.url + d } } } };The `bb` template generates a script that overrides `window.navigator.userAgent` via `Object.defineProperty` and this script is injected into the `<head>` of every iframe when the editor tab is active. Spoofing the User-Agent in the page's JavaScript context can deceive analytics, fraud-detection, or bot-mitigation scripts running on the visited page, and the injection runs inside iframes on third-party origins.
var bb = function(a) { a = X("string" === typeof a.userAgent, "userAgent", a.userAgent, "string"); return V("\n (function() {\n var userAgent = '" + W(a) + "';\n" + " Object.defineProperty(window.navigator, 'userAgent', {\n" + " get: function () {\n return userAgent;\n }\n });\n })()\n ")};// ...(function() { var a = cb; a.runtime.sendMessage({ command: "get", isFrame: !0 }, function(b) { if (b && b.success && b.editorTab) { var c = (b = b.deviceType) && S[b]; if (b && c) { b = c.a; c = Za(); c.classList.add("opt-user-agent-script"); var f = ha(); f && c.setAttribute("nonce", f); a.R(c, bb, { userAgent: b }); document.head.appendChild(c); } } })})();The external message handler (reachable from `https://optimize.google.com/optimize/*`) accepts a `"set"` command that stores a `host`, `token`, `modelUrl`, and `authUser` into chrome.storage and immediately activates a blocking webRequest header listener. These stored values directly control which remote URL is injected as a script on visited pages. If the `externally_connectable` origin were ever compromised or if the Google Optimize domain served attacker-controlled content, an adversary could redirect the injected script to a malicious endpoint.
var x = "host token modelUrl editorTab authUser checkRedirect deviceType language containerParams".split(" ");c.onMessageExternal.addListener(function(g, m, p) { var l = { success: !1, version: n() }; if ("set" === g.command) { var t = { host: g.host, token: g.token, modelUrl: g.modelUrl, authUser: g.authUser, deviceType: g.deviceType, language: g.language, editorTab: m.tab.id, checkRedirect: !0 }; if (g.containerPublicId) { var ta = { containerPublicId: g.containerPublicId, experiment: "edit", tabId: m.tab.id, startTimeMs: h() }; pa(f, ta); t.containerParams = ta; } ua(a, m.tab.id, g.deviceType); e.set(t).then(function() { l.success = !0; p(l) }, function() { l.success = !1; p(l) }); return !0 } // ..."preview" command also accepted});The content script runs at `document_start` in every frame on every HTTP/HTTPS page. Combined with the `debugger`, `webRequestBlocking`, and broad host permissions, the extension has the capability to observe and modify virtually all web activity in the browser. Running at `document_start` in `all_frames` means the script executes even inside sandboxed iframes and before any page JavaScript, giving it the earliest possible access to page state.
{ "content_scripts": [ { "run_at": "document_start", "matches": [ "http://*/*", "https://*/*" ], "all_frames": true, "js": [ "content.js" ] } ], "permissions": [ "storage", "debugger", "webRequest", "webRequestBlocking", "tabs", "http://*/", "https://*/" ]}By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.44.3 | 5 |
| 0.44.2 | 8 |
Files with findings
3 distinct paths — top paths by unique finding count:
- background.js7
- content.js5
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.