Google Optimize

ID: bhdplaindhdkiflmbfbciehdccfhegci

Could be malicious

Supported Languages

๐Ÿ‡ง๐Ÿ‡ฌBulgarian
๐Ÿ‡ช๐Ÿ‡ธCatalan
๐Ÿ‡ญ๐Ÿ‡ทCroatian
๐Ÿ‡จ๐Ÿ‡ฟCzech
๐Ÿ‡ฉ๐Ÿ‡ฐDanish
๐Ÿ‡ณ๐Ÿ‡ฑDutch
๐Ÿ‡บ๐Ÿ‡ธEnglish
๐Ÿ‡ต๐Ÿ‡ญFilipino
๐Ÿ‡ซ๐Ÿ‡ฎFinnish
๐Ÿ‡ซ๐Ÿ‡ทFrench
๐Ÿ‡ฉ๐Ÿ‡ชGerman
๐Ÿ‡ฌ๐Ÿ‡ทGreek
๐Ÿ‡ฎ๐Ÿ‡ณHindi
๐Ÿ‡ญ๐Ÿ‡บHungarian
๐Ÿ‡ฎ๐Ÿ‡ฉIndonesian
๐Ÿ‡ฎ๐Ÿ‡นItalian
๐Ÿ‡ฏ๐Ÿ‡ตJapanese
๐Ÿ‡ฐ๐Ÿ‡ทKorean
๐Ÿ‡ฑ๐Ÿ‡ปLatvian
๐Ÿ‡ฑ๐Ÿ‡นLithuanian
๐Ÿ‡ณ๐Ÿ‡ดNorwegian
๐Ÿ‡ต๐Ÿ‡ฑPolish
๐Ÿ‡ท๐Ÿ‡ดRomanian
๐Ÿ‡ท๐Ÿ‡บRussian
๐Ÿ‡ท๐Ÿ‡ธSerbian
๐Ÿ‡ธ๐Ÿ‡ฐSlovak
๐Ÿ‡ธ๐Ÿ‡ฎSlovenian
๐Ÿ‡ช๐Ÿ‡ธSpanish
๐Ÿ‡ธ๐Ÿ‡ชSwedish
๐Ÿ‡น๐Ÿ‡ญThai
๐Ÿ‡น๐Ÿ‡ทTurkish
๐Ÿ‡บ๐Ÿ‡ฆUkrainian
๐Ÿ‡ป๐Ÿ‡ณVietnamese

Extension Info & Metadata

Status
Removed
Version
0.44.3
Size
0.13 MB
Rating
4.3/5
Reviews
68
Users
537,465
Type
Extension
Updated
Jan 27, 2022
Category
11_web-development
Price
Free
Featured
No
Visibility
Unlisted
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
https://optimize.google.comView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
0
Unlisted
1
Total Users
537,465

Facilitates editing content with Google Optimize.

The Optimize extension helps you test and personalize your site with Google Optimize. Create better site experiences with Optimize. Once the extension is downloaded, use our visual editor to change just about anything on your site โ€“ text, images, layouts and more โ€“ and then preview how these new experiences will look on various devices before launching your site experiment. Learn more about Optimize at g.co/optimize. By installing this item, you agree to use it in accordance with your applicable Optimize terms, if any. Otherwise, you agree to the Google Terms of Service and Privacy Policy at https://policies.google.com/privacy

Item
Type
Severity
Description
debugger
Permission
Critical
This permission grants the extension ability to debug and control other extensions and browser tabs. Rated Critical because it can access and modify other extensions' internal state, inject code, and access sensitive data from any tab.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking
Permission
Critical
This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
Dangerous Permission Combination
Risk Factor
Critical
This extension can intercept, modify, and block web requests in real-time.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:โ€ข 10% increase: Early script execution enables pre-emptive content manipulationโ€ข 15% increase: Older manifest version lacks modern security controls
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2
http://*/
Permission
Unknown
No classification available for this permission.
https://*/
Permission
Unknown
No classification available for this permission.

This content script constructs a remote script URL from runtime-supplied parameters and injects it into the page context on arbitrary sites. Because the extension runs on all HTTP/HTTPS pages, this is effectively remote code loading with page-level execution, which is a high-risk pattern even if intended for Optimize preview.

content.js (Line 949)
var jb = function(a, b) {    var c = a.U,      f = a.$,      e = a.token,      k = a.authUser,      d = a.language,      g = a.deviceType,      h = a.S;    a = a.nonce;    fb();    W["opt.extension.editor.soy.init"] ? b = W["opt.extension.editor.soy.init"]({        U: c,        $: f,        token: e,        authUser: k,        language: d,        deviceType: g,        S: h,        nonce: a      }, b) : (X("string" === typeof c, "injectJsUrl", c, "string"), X("string" === typeof f, "tokenParam", f,          "string"), X("string" === typeof e, "token", e, "string"), X("string" === typeof k, "authUser", k, "string"), X(          "string" === typeof d, "language", d, "string"), X("string" === typeof g, "deviceType",          g, "string"), X(ha(h), "i18nMessages", h,          "{internalError: string, failedToLoad: string, checkNetwork: string,}"), X("string" === typeof a, "nonce", a,          "string"), b = U("\n    (function() {\n  var injectSrc = '" + V(c) + "?" + V(f) + "=" + V(e) + ("" != k ?            "&authuser=" + V(k) : "") + ("" != g ? "&devicetype=" + V(g) : "") + ("" != d ? "&hl=" + V(d) : "") +          "'; var nonce = '" + V(a) +          "';\n      if(window['_google_opt_edit']) {\n        return;\n      }\n      window['_google_opt_edit'] = {};\n      var injectScript = document.createElement('script');\n      injectScript.type = 'text/javascript';\n      injectScript.src = injectSrc;\n      if (nonce) {\n        injectScript.setAttribute('nonce', nonce);\n      }\n      if (document.head) {\n        document.head.appendChild(injectScript);\n      } else {\n        document.insertBefore(injectScript, document.body);\n      }\n\n      window['_goptInjectInitOnError'] = function(internalError) {\n        alert((internalError ? '" +          V(h.ja) + "' : '" + V(h.ga) + "') + ' " + V(h.da) +

The extension accepts externally supplied `host`, `token`, `modelUrl`, and device settings from a web page and persists them without validating the destination. In combination with the injected loader in `content.js`, a compromised or abused trusted origin could steer the extension to load active content into arbitrary tabs.

background.js (Line 1272)
c.onMessageExternal.addListener(function(l, q, r) {      var p = {        success: !1,        version: h()      };      if ("set" === l.command) {        var t = {          host: l.host,          token: l.token,          modelUrl: l.modelUrl,          authUser: l.authUser,          deviceType: l.deviceType,          language: l.language,          editorTab: q.tab.id,          checkRedirect: !0        };        if (l.containerPublicId) {          var ra = {            containerPublicId: l.containerPublicId,            experiment: "edit",            tabId: q.tab.id,            startTimeMs: d()          };          qa(g, ra);          t.containerParams =            ra        }        va(a, q.tab.id, l.deviceType);        f.set(t)          .then(function() {              p.success = !0;              r(p)

This blocking `webRequest` handler rewrites matching script requests by appending preview, auth, experiment, and debug parameters. It is a clear network interception pattern that alters page resource loading behavior and could be abused to redirect analytics/experiment scripts with privileged preview credentials.

background.js (Line 737)
pa = function(a, b) {  return function(c) {    if (144E5 <= a.fa() - b.startTimeMs) a.storage.remove(["containerParams"]), G(a);    else if (c.url &&      (-1 !== c.url.indexOf("/gtm/js?id=" + b.containerPublicId) || -1 !== c.url.indexOf("/optimize.js?id=" + b        .containerPublicId))) {      var e = "";      b.resourceKey && (e += "&gtm_preview=" + encodeURIComponent(b.resourceKey));      b.auth && (e += "&gtm_auth=" + encodeURIComponent(b.auth));      b.experiment && (e += "&gtm_experiment=" + encodeURIComponent(b.experiment));      b.debug && (e += "&gtm_debug=" + b.debug);      if (-1 === c.url.indexOf(e)) return {        redirectUrl: c.url + e      }    }  }};

This code installs a blocking header-rewrite hook on `<all_urls>` and replaces the `User-Agent` header for the target tab. Modifying request headers across arbitrary destinations is a powerful interception capability that can disguise traffic or alter server-side behavior.

background.js (Line 792)
var va = function(a, b, c) {    ta(a);    c && (a.l = ua(c), a.l && a.webRequest.onBeforeSendHeaders.addListener(a.l, {      urls: ["<all_urls>"],      tabId: b    }, ["blocking", "requestHeaders"]))  },  ta = function(a) {    a.l && a.webRequest.onBeforeSendHeaders.removeListener(a.l);    a.l = null  };function ua(a) {  a = F[a];  if (!a) return null;  var b = a.s;  return b ? function(c) {      if (c.requestHeaders) {        for (var e = 0; e < c.requestHeaders.length; ++e) {          var f = c.requestHeaders[e];          if ("user-agent" === f.name.toLowerCase()) {            f.value = b;            break          }        }        return {          requestHeaders: c.requestHeaders        }      }

The content script directly reads and writes page cookies and manages a `__TAG_ASSISTANT` cookie from a script injected into every page at `document_start`. While this appears tied to preview state, cookie manipulation across arbitrary sites is a sensitive capability that can affect session or experiment behavior outside the page's normal controls.

content.js (Line 664)
function Ma(a, b, c) {  var f = Na(),    e = window;  "null" !== e.origin && (e.document.cookie = a);  a = Na();  if (!(f = f != a) && (f = void 0 != b)) {    if (Oa(c))      for (c = [], a = String(a || Na())        .split(";"), f = 0; f < a.length; f++) {        e = a[f].split("=");        var k = e[0].replace(/^\s*|\s*$/g, "");        k && "__TAG_ASSISTANT" == k && (e = e.slice(1)          .join("=")          .replace(/^\s*|\s*$/g, ""), c.push(e))      } else c = [];    f = 0 <= c.indexOf(b)  }  return f}var Sa = function(a) {    function b(q, r, m) {      if (null == m) return delete k[r], q;      k[r] = m;      return q + "; " + r + "=" + m    }    function c(q, r) {      if (null == r) return delete k[r], q;      k[r] = !0;      return q + "; " + r

By severity

Critical2
High5
Medium6
Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
0.44.35
0.44.28

Files with findings

3 distinct paths โ€” top paths by unique finding count:

  • background.js7
  • content.js5
  • manifest.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Remote Code Loading
critical
content.js (line 949)This content script constructs a remote script URL from runtime-supplied parameters and injects it into the page context on arbitrary sites. Because the extension runs on all HTTP/HTTPS pages, this is effectively remoโ€ฆ
2Remote Code Loading
critical
content.js (line 38)When a token is present, the content script constructs a remote script URL by concatenating a `host` value (retrieved from chrome.storage, originally supplied via an external message from optimize.google.com) with `/oโ€ฆ
3Network Interception
high
background.js (line 21)A blocking `onBeforeSendHeaders` listener is registered against `<all_urls>` for the active tab. It intercepts every outgoing HTTP/HTTPS request and rewrites the `User-Agent` header before the request is sent. Runningโ€ฆ
4Network Interception
high
background.js (line 19)A blocking `onBeforeRequest` listener intercepts all script loads matching `optimize.js` or `gtm/js` URLs and redirects them by appending authentication and experiment parameters (`gtm_auth`, `gtm_preview`, `gtm_experโ€ฆ
5Privilege Escalation
high
background.js (line 20)The extension uses the `chrome.debugger` API to attach to arbitrary browser tabs and send Chrome DevTools Protocol commands including `Network.enable` (full network traffic visibility), `Network.setUserAgentOverride` โ€ฆ
6Remote Code Loading
high
background.js (line 1272)The extension accepts externally supplied `host`, `token`, `modelUrl`, and device settings from a web page and persists them without validating the destination. In combination with the injected loader in `content.js`,โ€ฆ
7Remote Code Loading
high
content.js (line 36)The `ab` Soy template generates an IIFE string (injected as a `<script>` tag into the target page) that dynamically creates another script element whose `src` is the remote inject URL with auth token and user credentiโ€ฆ
8Network Interception
medium
background.js (line 737)This blocking `webRequest` handler rewrites matching script requests by appending preview, auth, experiment, and debug parameters. It is a clear network interception pattern that alters page resource loading behavior โ€ฆ
9Network Interception
medium
background.js (line 792)This code installs a blocking header-rewrite hook on `<all_urls>` and replaces the `User-Agent` header for the target tab. Modifying request headers across arbitrary destinations is a powerful interception capability โ€ฆ
10Other
medium
content.js (line 664)The content script directly reads and writes page cookies and manages a `__TAG_ASSISTANT` cookie from a script injected into every page at `document_start`. While this appears tied to preview state, cookie manipulatioโ€ฆ
11Other
medium
content.js (line 37)The `bb` template generates a script that overrides `window.navigator.userAgent` via `Object.defineProperty` and this script is injected into the `<head>` of every iframe when the editor tab is active. Spoofing the Usโ€ฆ
12Other
medium
background.js (line 41)The external message handler (reachable from `https://optimize.google.com/optimize/*`) accepts a `"set"` command that stores a `host`, `token`, `modelUrl`, and `authUser` into chrome.storage and immediately activates โ€ฆ
13Unauthorized Data Collection
medium
manifest.json (line 9)The content script runs at `document_start` in every frame on every HTTP/HTTPS page. Combined with the `debugger`, `webRequestBlocking`, and broad host permissions, the extension has the capability to observe and modiโ€ฆ
URLs
18
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

support.google.com/optimize/answer/7388531https://support.google.com/optimize/answer/7388531
www.about.to.redirect.com-http://www.about.to.redirect.com/
redirect.result.com-http://redirect.result.com/
www.google.com-https://www.google.com/
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
*-http://*/
*-https://*/
*/*http://*/*
*/*https://*/*
optimize.google.com/optimize/*https://optimize.google.com/optimize/*
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Version
Size
Is Malicious
Findings
Permhash
0.44.2
Latest
0.13 MB
Malicious
8
0.44.3
0.13 MB
Malicious
5
Showing 1 to 2 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.