What our analysis found

High or Low Casino Game is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by remote code loading. It comes from a trusted publisher and was last updated in April 2026.

Key findings

• high· remote code loading —The server response field ` ` is an arbitrary HTML string that is parsed and appended into the extension page's DOM, with the display duration also dictated by the server (` _timer`). The extension_pages CSP (`script-src 'self'`) blocks scripts inside that markup, but it does not block remote iframes, forms, links or full-page overlays rendered inside a trusted chrome-extension:// origin, so the operator of mines.cloudapi.stream can push arbitrary phishing or credential-harvesting UI to all 753 installs at will. The destination is the same cloudapi[.]stream infrastructure named in the Socket 108-extension C2 campaign IoC, and this injection point is invoked on every bet via onPlayerSelection (:1971), giving the server a per-action beacon and delivery window.
• high· other —The bundled manifest for 2.6.1 declares empty `permissions` and `host_permissions`, while the live CWS listing declares `identity` plus host access to and A card game needs neither Google OAuth identity tokens nor access, and this is precisely the escalation pattern of a delayed-malicious update; the reviewed ZIP therefore understates the currently-shipping privilege set. `externally_connectable: <all_urls>` is additionally declared here with no chrome.runtime.onMessageExternal listener anywhere in the bundle, leaving any web page able to message a future build of this extension.

The game logic itself is stock CodeThisLab "High or Low" HTML5 template code, but:3046 adds a bespoke `fetchSettings()` that POSTs to on every single bet (called from onPlayerSelection,:1971) and takes back a ` ` HTML string which is parsed and appended straight into document.body with a server-controlled removal timer — a live, remotely-steered content-injection channel into a chrome-extension:// page, and cloudapi[.]stream is the exact C2 domain of the Socket 108-extension campaign. Corroborating but secondary: the bundled 2.6.1 manifest declares zero permissions while the live CWS listing now ships `identity` + host permissions (escalation after the reviewed build), `externally_connectable: <all_urls>` is declared with no listener anywhere in the bundle (staged capability), and of the publisher's other extensions are flagged malicious. Contradicting: our risk engine scored 0.00 and chrome-stats is only, and the reviewed ZIP contains no theft, no cookie or history access and no obfuscation — so the malicious payload here is a dormant delivery channel rather than proven in-code theft, which is why this is likely_malicious rather than malicious.