Security Alert: Confirmed Malware
Google Optimize
ID: bhdplaindhdkiflmbfbciehdccfhegci
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://optimize.google.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Facilitates editing content with Google Optimize.
The Optimize extension helps you test and personalize your site with Google Optimize. Create better site experiences with Optimize. Once the extension is downloaded, use our visual editor to change just about anything on your site โ text, images, layouts and more โ and then preview how these new experiences will look on various devices before launching your site experiment. Learn more about Optimize at g.co/optimize. By installing this item, you agree to use it in accordance with your applicable Optimize terms, if any. Otherwise, you agree to the Google Terms of Service and Privacy Policy at https://policies.google.com/privacy
This content script constructs a remote script URL from runtime-supplied parameters and injects it into the page context on arbitrary sites. Because the extension runs on all HTTP/HTTPS pages, this is effectively remote code loading with page-level execution, which is a high-risk pattern even if intended for Optimize preview.
var jb = function(a, b) { var c = a.U, f = a.$, e = a.token, k = a.authUser, d = a.language, g = a.deviceType, h = a.S; a = a.nonce; fb(); W["opt.extension.editor.soy.init"] ? b = W["opt.extension.editor.soy.init"]({ U: c, $: f, token: e, authUser: k, language: d, deviceType: g, S: h, nonce: a }, b) : (X("string" === typeof c, "injectJsUrl", c, "string"), X("string" === typeof f, "tokenParam", f, "string"), X("string" === typeof e, "token", e, "string"), X("string" === typeof k, "authUser", k, "string"), X( "string" === typeof d, "language", d, "string"), X("string" === typeof g, "deviceType", g, "string"), X(ha(h), "i18nMessages", h, "{internalError: string, failedToLoad: string, checkNetwork: string,}"), X("string" === typeof a, "nonce", a, "string"), b = U("\n (function() {\n var injectSrc = '" + V(c) + "?" + V(f) + "=" + V(e) + ("" != k ? "&authuser=" + V(k) : "") + ("" != g ? "&devicetype=" + V(g) : "") + ("" != d ? "&hl=" + V(d) : "") + "'; var nonce = '" + V(a) + "';\n if(window['_google_opt_edit']) {\n return;\n }\n window['_google_opt_edit'] = {};\n var injectScript = document.createElement('script');\n injectScript.type = 'text/javascript';\n injectScript.src = injectSrc;\n if (nonce) {\n injectScript.setAttribute('nonce', nonce);\n }\n if (document.head) {\n document.head.appendChild(injectScript);\n } else {\n document.insertBefore(injectScript, document.body);\n }\n\n window['_goptInjectInitOnError'] = function(internalError) {\n alert((internalError ? '" + V(h.ja) + "' : '" + V(h.ga) + "') + ' " + V(h.da) +The extension accepts externally supplied `host`, `token`, `modelUrl`, and device settings from a web page and persists them without validating the destination. In combination with the injected loader in `content.js`, a compromised or abused trusted origin could steer the extension to load active content into arbitrary tabs.
c.onMessageExternal.addListener(function(l, q, r) { var p = { success: !1, version: h() }; if ("set" === l.command) { var t = { host: l.host, token: l.token, modelUrl: l.modelUrl, authUser: l.authUser, deviceType: l.deviceType, language: l.language, editorTab: q.tab.id, checkRedirect: !0 }; if (l.containerPublicId) { var ra = { containerPublicId: l.containerPublicId, experiment: "edit", tabId: q.tab.id, startTimeMs: d() }; qa(g, ra); t.containerParams = ra } va(a, q.tab.id, l.deviceType); f.set(t) .then(function() { p.success = !0; r(p)This blocking `webRequest` handler rewrites matching script requests by appending preview, auth, experiment, and debug parameters. It is a clear network interception pattern that alters page resource loading behavior and could be abused to redirect analytics/experiment scripts with privileged preview credentials.
pa = function(a, b) { return function(c) { if (144E5 <= a.fa() - b.startTimeMs) a.storage.remove(["containerParams"]), G(a); else if (c.url && (-1 !== c.url.indexOf("/gtm/js?id=" + b.containerPublicId) || -1 !== c.url.indexOf("/optimize.js?id=" + b .containerPublicId))) { var e = ""; b.resourceKey && (e += ">m_preview=" + encodeURIComponent(b.resourceKey)); b.auth && (e += ">m_auth=" + encodeURIComponent(b.auth)); b.experiment && (e += ">m_experiment=" + encodeURIComponent(b.experiment)); b.debug && (e += ">m_debug=" + b.debug); if (-1 === c.url.indexOf(e)) return { redirectUrl: c.url + e } } }};This code installs a blocking header-rewrite hook on `<all_urls>` and replaces the `User-Agent` header for the target tab. Modifying request headers across arbitrary destinations is a powerful interception capability that can disguise traffic or alter server-side behavior.
var va = function(a, b, c) { ta(a); c && (a.l = ua(c), a.l && a.webRequest.onBeforeSendHeaders.addListener(a.l, { urls: ["<all_urls>"], tabId: b }, ["blocking", "requestHeaders"])) }, ta = function(a) { a.l && a.webRequest.onBeforeSendHeaders.removeListener(a.l); a.l = null };function ua(a) { a = F[a]; if (!a) return null; var b = a.s; return b ? function(c) { if (c.requestHeaders) { for (var e = 0; e < c.requestHeaders.length; ++e) { var f = c.requestHeaders[e]; if ("user-agent" === f.name.toLowerCase()) { f.value = b; break } } return { requestHeaders: c.requestHeaders } }The content script directly reads and writes page cookies and manages a `__TAG_ASSISTANT` cookie from a script injected into every page at `document_start`. While this appears tied to preview state, cookie manipulation across arbitrary sites is a sensitive capability that can affect session or experiment behavior outside the page's normal controls.
function Ma(a, b, c) { var f = Na(), e = window; "null" !== e.origin && (e.document.cookie = a); a = Na(); if (!(f = f != a) && (f = void 0 != b)) { if (Oa(c)) for (c = [], a = String(a || Na()) .split(";"), f = 0; f < a.length; f++) { e = a[f].split("="); var k = e[0].replace(/^\s*|\s*$/g, ""); k && "__TAG_ASSISTANT" == k && (e = e.slice(1) .join("=") .replace(/^\s*|\s*$/g, ""), c.push(e)) } else c = []; f = 0 <= c.indexOf(b) } return f}var Sa = function(a) { function b(q, r, m) { if (null == m) return delete k[r], q; k[r] = m; return q + "; " + r + "=" + m } function c(q, r) { if (null == r) return delete k[r], q; k[r] = !0; return q + "; " + rBy severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.44.3 | 5 |
| 0.44.2 | 8 |
Files with findings
3 distinct paths โ top paths by unique finding count:
- background.js7
- content.js5
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.