Chrome Web Store

93Versions

1Code reviewed

No malware found

In code review (v1.1.15)

Our reviewer read version 1.1.15 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Hover Zoom+, used by 300,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites and can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

The extension is a well-known open-source image zoom tool. The source code shows only enhancement logic, with no data exfiltration, tracking, or malicious code injection. All network requests fetch images or image metadata directly from image hosts, consistent with the extension's purpose. The broad permissions are necessary for its functionality across all sites. The ML model gave a low risk (0.00), and the risk-engine flagged permissions generically, but manual review confirms benign behavior.

Hover Zoom+ Chrome extension security report

ID: pccckmaobkjjboncdfnnofkonhgpceea

Supported Languages

🇪🇹Amharic

🇸🇦Arabic

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇱Hebrew

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇮🇳Kannada

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇮🇷Persian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇰🇪Swahili

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Active

Version

1.1.17

Size

1.52 MB

Rating

4.0/5

Reviews

1,505

Users

300,000

Type

Extension

Updated

Sep 10, 2026

Publisher Contextual Analysis

Trusted

Author: HoverZoom+
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Extensions

Active

Obsolete

Listed

Unlisted

Users

300,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Install growth

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

14 versions released in this period

Rating Count

Total: 1,262 ratings+1 (0%)

Average Rating

Current: 4.02 / 5.0-0.01

See plans

React Flow

Internal permhash`50c1d953c8…`
No malicious matches

3 other extensions carry this fingerprint, none of them known malicious.

Withheldnot flagged
Withheldnot flagged
Withheldnot flagged

Permhash (Mandiant)`0a0366aeda…`
No malicious matches

4 other extensions carry this fingerprint, none of them known malicious.

Withheldnot flagged
Withheldnot flagged
Withheldnot flagged
Withheldnot flagged

Network indicators

878 URLs and 6 IP literals were extracted from this version.

Item	Type	Severity	Description
declarativeNetRequest	Permission	Critical	This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
scripting	Permission	Critical	This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
:///*	Host	Critical	Broad host access — the extension can read/modify content on every website.
<all_urls>	Risk Factor	Critical	This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation
Broad Host Permissions	Risk Factor	High	This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access	Risk Factor	High	This extension can inject scripts into any website.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
unlimitedStorage	Permission	Medium	This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
Access to Sensitive Domains	Risk Factor	Medium	This extension requests access to sensitive domains: ://.facebook.com/, ://.search.yahoo.com/, ://.search.yahoo.co.jp/, ://.google.ad/, ://.google.ae/, ://.google.am/, ://.google.as/, ://.google.at/, ://.google.az/, ://.google.ba/, ://.google.be/, ://.google.bg/, ://.google.bi/, ://.google.bj/, ://.google.bs/, ://.google.ca/, ://.google.cat/, ://.google.cd/, ://.google.cf/, ://.google.cg/, ://.google.ch/, ://.google.ci/, ://.google.cl/, ://.google.cn/, ://.google.co.bw/, ://.google.co.ck/, ://.google.co.cr/, ://.google.co.id/, ://.google.co.il/, ://.google.co.in/, ://.google.co.jp/, ://.google.co.ke/, ://.google.co.kr/, ://.google.co.ls/, ://.google.co.ma/, ://.google.co.mz/, ://.google.co.nz/, ://.google.co.th/, ://.google.co.tz/, ://.google.co.ug/, ://.google.co.uk/, ://.google.co.uz/, ://.google.co.ve/, ://.google.co.vi/, ://.google.co.za/, ://.google.co.zm/, ://.google.co.zw/, ://.google.com.af/, ://.google.com.ag/, ://.google.com.ai/, ://.google.com.ar/, ://.google.com.au/, ://.google.com.bd/, ://.google.com.bh/, ://.google.com.bn/, ://.google.com.bo/, ://.google.com.br/, ://.google.com.by/, ://.google.com.bz/, ://.google.com.co/, ://.google.com.cu/, ://.google.com.cy/, ://.google.com.do/, ://.google.com.ec/, ://.google.com.eg/, ://.google.com.et/, ://.google.com.fj/, ://.google.com.gh/, ://.google.com.gi/, ://.google.com.gt/, ://.google.com.hk/, ://.google.com.jm/, ://.google.com.kh/, ://.google.com.kw/, ://.google.com.lb/, ://.google.com.ly/, ://.google.com.mt/, ://.google.com.mx/, ://.google.com.my/, ://.google.com.na/, ://.google.com.nf/, ://.google.com.ng/, ://.google.com.ni/, ://.google.com.np/, ://.google.com.om/, ://.google.com.pa/, ://.google.com.pe/, ://.google.com.ph/, ://.google.com.pk/, ://.google.com.pr/, ://.google.com.py/, ://.google.com.qa/, ://.google.com.sa/, ://.google.com.sb/, ://.google.com.sg/, ://.google.com.sl/, ://.google.com.sv/, ://.google.com.tj/, ://.google.com.tr/, ://.google.com.tw/, ://.google.com.ua/, ://.google.com.uy/, ://.google.com.vc/, ://.google.com.vn/, ://.google.com/, ://.google.cz/, ://.google.de/, ://.google.dj/, ://.google.dk/, ://.google.dm/, ://.google.dz/, ://.google.ee/, ://.google.es/, ://.google.fi/, ://.google.fm/, ://.google.fr/, ://.google.ga/, ://.google.ge/, ://.google.gg/, ://.google.gl/, ://.google.gm/, ://.google.gp/, ://.google.gr/, ://.google.gy/, ://.google.hn/, ://.google.hr/, ://.google.ht/, ://.google.hu/, ://.google.ie/, ://.google.im/, ://.google.is/, ://.google.it.ao/, ://.google.it/, ://.google.je/, ://.google.jo/, ://.google.kg/, ://.google.ki/, ://.google.kz/, ://.google.la/, ://.google.li/, ://.google.lk/, ://.google.lt/, ://.google.lu/, ://.google.lv/, ://.google.md/, ://.google.me/, ://.google.mg/, ://.google.mk/, ://.google.mn/, ://.google.ms/, ://.google.mu/, ://.google.mv/, ://.google.mw/, ://.google.nl/, ://.google.no/, ://.google.nr/, ://.google.nu/, ://.google.pl/, ://.google.pn/, ://.google.ps/, ://.google.pt/, ://.google.ro/, ://.google.rs/, ://.google.ru/, ://.google.rw/, ://.google.sc/, ://.google.se/, ://.google.sh/, ://.google.si/, ://.google.sk/, ://.google.sm/, ://.google.sn/, ://.google.st/, ://.google.td/, ://.google.tg/, ://.google.tk/, ://.google.tl/, ://.google.tm/, ://.google.to/, ://.google.tt/, ://.google.vg/, ://.google.vu/, ://.google.ws/, ://linuxmint-art.org/, ://.amazon.com/, ://.amazon.com.au/, ://.amazon.com.br/, ://.amazon.com.mx/, ://.amazon.com.tr/, ://.amazon.ae/, ://.amazon.ca/, ://.amazon.cn/, ://.amazon.de/, ://.amazon.eg/, ://.amazon.es/, ://.amazon.fr/, ://.amazon.co.jp/, ://.amazon.co.uk/, ://.amazon.in/, ://.amazon.it/, ://.amazon.nl/, ://.amazon.sg/, ://.ebay.at/, ://.ebay.be/, ://.ebay.ch/, ://.ebay.co.th/, ://.ebay.co.uk/, ://.ebay.com.au/, ://.ebay.com.hk/, ://.ebay.com.my/, ://.ebay.com.sg/, ://.ebay.com/, ://.ebay.de/, ://.ebay.es/, ://.ebay.fr/, ://.ebay.ie/, ://.ebay.in/, ://.ebay.it/, ://.ebay.nl/, ://.ebay.ph/, ://.ebay.pl/, ://.twitter.com/, ://.xing.com/, ://.kotaku.com/, ://.linkedin.com/, ://.zing.vn/, ://.artsblog.it/, ://.betsblog.it/, ://.finanzablog.it/, ://mail.google.com/, ://.bing.com/, ://.craigslist.org/, ://.github.com/, ://.instagram.com/, ://.foursquare.com/, ://.booking.com/, ://.thingiverse.com/, ://.gitlab.com/, ://docs.google.com/spreadsheets/, ://.kleinanzeigen.de/, ://drive.google.com/, ://.stackoverflow.com/
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.

Sensitive Domain Access

This extension has access to the following sensitive domains:

*://*.facebook.com/*
*://*.search.yahoo.com/*
*://*.search.yahoo.co.jp/*
*://*.google.ad/*
*://*.google.ae/*
*://*.google.am/*
*://*.google.as/*
*://*.google.at/*
*://*.google.az/*
*://*.google.ba/*
*://*.google.be/*
*://*.google.bg/*
*://*.google.bi/*
*://*.google.bj/*
*://*.google.bs/*
*://*.google.ca/*
*://*.google.cat/*
*://*.google.cd/*
*://*.google.cf/*
*://*.google.cg/*
*://*.google.ch/*
*://*.google.ci/*
*://*.google.cl/*
*://*.google.cn/*
*://*.google.co.bw/*
*://*.google.co.ck/*
*://*.google.co.cr/*
*://*.google.co.id/*
*://*.google.co.il/*
*://*.google.co.in/*
*://*.google.co.jp/*
*://*.google.co.ke/*
*://*.google.co.kr/*
*://*.google.co.ls/*
*://*.google.co.ma/*
*://*.google.co.mz/*
*://*.google.co.nz/*
*://*.google.co.th/*
*://*.google.co.tz/*
*://*.google.co.ug/*
*://*.google.co.uk/*
*://*.google.co.uz/*
*://*.google.co.ve/*
*://*.google.co.vi/*
*://*.google.co.za/*
*://*.google.co.zm/*
*://*.google.co.zw/*
*://*.google.com.af/*
*://*.google.com.ag/*
*://*.google.com.ai/*
*://*.google.com.ar/*
*://*.google.com.au/*
*://*.google.com.bd/*
*://*.google.com.bh/*
*://*.google.com.bn/*
*://*.google.com.bo/*
*://*.google.com.br/*
*://*.google.com.by/*
*://*.google.com.bz/*
*://*.google.com.co/*
*://*.google.com.cu/*
*://*.google.com.cy/*
*://*.google.com.do/*
*://*.google.com.ec/*
*://*.google.com.eg/*
*://*.google.com.et/*
*://*.google.com.fj/*
*://*.google.com.gh/*
*://*.google.com.gi/*
*://*.google.com.gt/*
*://*.google.com.hk/*
*://*.google.com.jm/*
*://*.google.com.kh/*
*://*.google.com.kw/*
*://*.google.com.lb/*
*://*.google.com.ly/*
*://*.google.com.mt/*
*://*.google.com.mx/*
*://*.google.com.my/*
*://*.google.com.na/*
*://*.google.com.nf/*
*://*.google.com.ng/*
*://*.google.com.ni/*
*://*.google.com.np/*
*://*.google.com.om/*
*://*.google.com.pa/*
*://*.google.com.pe/*
*://*.google.com.ph/*
*://*.google.com.pk/*
*://*.google.com.pr/*
*://*.google.com.py/*
*://*.google.com.qa/*
*://*.google.com.sa/*
*://*.google.com.sb/*
*://*.google.com.sg/*
*://*.google.com.sl/*
*://*.google.com.sv/*
*://*.google.com.tj/*
*://*.google.com.tr/*
*://*.google.com.tw/*
*://*.google.com.ua/*
*://*.google.com.uy/*
*://*.google.com.vc/*
*://*.google.com.vn/*
*://*.google.com/*
*://*.google.cz/*
*://*.google.de/*
*://*.google.dj/*
*://*.google.dk/*
*://*.google.dm/*
*://*.google.dz/*
*://*.google.ee/*
*://*.google.es/*
*://*.google.fi/*
*://*.google.fm/*
*://*.google.fr/*
*://*.google.ga/*
*://*.google.ge/*
*://*.google.gg/*
*://*.google.gl/*
*://*.google.gm/*
*://*.google.gp/*
*://*.google.gr/*
*://*.google.gy/*
*://*.google.hn/*
*://*.google.hr/*
*://*.google.ht/*
*://*.google.hu/*
*://*.google.ie/*
*://*.google.im/*
*://*.google.is/*
*://*.google.it.ao/*
*://*.google.it/*
*://*.google.je/*
*://*.google.jo/*
*://*.google.kg/*
*://*.google.ki/*
*://*.google.kz/*
*://*.google.la/*
*://*.google.li/*
*://*.google.lk/*
*://*.google.lt/*
*://*.google.lu/*
*://*.google.lv/*
*://*.google.md/*
*://*.google.me/*
*://*.google.mg/*
*://*.google.mk/*
*://*.google.mn/*
*://*.google.ms/*
*://*.google.mu/*
*://*.google.mv/*
*://*.google.mw/*
*://*.google.nl/*
*://*.google.no/*
*://*.google.nr/*
*://*.google.nu/*
*://*.google.pl/*
*://*.google.pn/*
*://*.google.ps/*
*://*.google.pt/*
*://*.google.ro/*
*://*.google.rs/*
*://*.google.ru/*
*://*.google.rw/*
*://*.google.sc/*
*://*.google.se/*
*://*.google.sh/*
*://*.google.si/*
*://*.google.sk/*
*://*.google.sm/*
*://*.google.sn/*
*://*.google.st/*
*://*.google.td/*
*://*.google.tg/*
*://*.google.tk/*
*://*.google.tl/*
*://*.google.tm/*
*://*.google.to/*
*://*.google.tt/*
*://*.google.vg/*
*://*.google.vu/*
*://*.google.ws/*
*://linuxmint-art.org/*
*://*.amazon.com/*
*://*.amazon.com.au/*
*://*.amazon.com.br/*
*://*.amazon.com.mx/*
*://*.amazon.com.tr/*
*://*.amazon.ae/*
*://*.amazon.ca/*
*://*.amazon.cn/*
*://*.amazon.de/*
*://*.amazon.eg/*
*://*.amazon.es/*
*://*.amazon.fr/*
*://*.amazon.co.jp/*
*://*.amazon.co.uk/*
*://*.amazon.in/*
*://*.amazon.it/*
*://*.amazon.nl/*
*://*.amazon.sg/*
*://*.ebay.at/*
*://*.ebay.be/*
*://*.ebay.ch/*
*://*.ebay.co.th/*
*://*.ebay.co.uk/*
*://*.ebay.com.au/*
*://*.ebay.com.hk/*
*://*.ebay.com.my/*
*://*.ebay.com.sg/*
*://*.ebay.com/*
*://*.ebay.de/*
*://*.ebay.es/*
*://*.ebay.fr/*
*://*.ebay.ie/*
*://*.ebay.in/*
*://*.ebay.it/*
*://*.ebay.nl/*
*://*.ebay.ph/*
*://*.ebay.pl/*
*://*.twitter.com/*
*://*.xing.com/*
*://*.kotaku.com/*
*://*.linkedin.com/*
*://*.zing.vn/*
*://*.artsblog.it/*
*://*.betsblog.it/*
*://*.finanzablog.it/*
*://mail.google.com/*
*://*.bing.com/*
*://*.craigslist.org/*
*://*.github.com/*
*://*.instagram.com/*
*://*.foursquare.com/*
*://*.booking.com/*
*://*.thingiverse.com/*
*://*.gitlab.com/*
*://docs.google.com/spreadsheets/*
*://*.kleinanzeigen.de/*
*://drive.google.com/*
*://*.stackoverflow.com/*

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

About this extension

Zoom images/videos on all your favorite websites (Facebook, Amazon, etc). Simply hover your mouse over the image to enlarge it.

Read the publisher’s full description

Hover your mouse over any image on the supported websites and the extension will automatically enlarge the image to its full size, making sure that it still fits into the browser window. This is an open source version of the original HoverZoom extension which is now overrun by malware and deleted from store. In this version all spyware has been removed, many bugs were fixed and new features were added. It doesn't collect any statistics by default. The only permission it needs is to access data on all websites (to extract full images), and *optional* permissions to access browser history, download/save images or get tab urls for per-site configuration. Sometimes sites change design and when it happens extension needs to be updated. Please report any issues with zoom not working by using Support tab or https://github.com/extesy/hoverzoom/issues page.

User reviews

3.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Something happened in a recent update, and the whole page except the image goes down and become unresponsive. I have to reload the page after disabling the extension. Been using this for years now and it worked great. Chrome Version 153.0.8010.48 (Official Build) (64-bit)

Abhimanyu·16 Sept 2026

Doesn't work on brave

William·26 Aug 2026

This extendsion has been a huge part of my designer professional life. Thank you so much for your brillian idea and generosity!

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

878

IPv4

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found

No IP addresses found

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Version	Size	Verdict	Findings	Permhash
1.1.17 Latest	1.52 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.16	1.53 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.15	1.52 MB	No malware found	0	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.14	1.52 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.13	1.52 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.12	1.51 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.11	1.51 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.10	1.50 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.9	1.50 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50
1.1.8	1.50 MB	Not scanned	—	0a0366aedad2921aa7e2529d5ac33cfbcacc457e2450ac6a2374e8364a6d5f50

Showing 1 to 10 of 100 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Popular in Functionality & UI

IDM Integration Module18,000,000 users
Video Speed Controller3,000,000 users
OneTab2,000,000 users
SponsorBlock for YouTube - Skip Sponsorships2,000,000 users
Click&Clean1,000,000 users

No malware found

What our analysis found