Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Krisp for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Krisp for Chrome

ID: edmmlbmgelmbipapbhcncjblhejknomb

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1.7

Size

5.75 MB

Rating

3.6/5

Reviews

Users

170,711

Type

Extension

Updated

Oct 29, 2020

Publisher Contextual Analysis

Author: http://krisp.aiView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

170,711

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Remove background noise during calls with Krisp for Chrome

THE EXTENSION WILL BE DISCONTINUED. READ MORE HERE --> https://help.krisp.ai/hc/en-us/articles/360017077240-Discontinuing-the-Krisp-Chrome-extension --------- By installing this extension, you agree to Krisp’s Terms and Conditions (https://krisp.ai/terms-of-use/). Krisp allows you to remove background noise (screaming kids, barking dogs, airport noise, etc) during conference calls. WIth Krisp installed, you can continue using your favorite conferencing apps and not worry about background noise anymore. ★ Speak without noise With a single button, the background noise going from you to other call participants will be removed ★ Supports all web conferencing apps Compatible with all communication web apps running inside Chrome ★ Privacy comes first All audio processing is performed locally. Krisp never sends your voice to its servers. ★ Works with any headset Use any microphone and external headset with Krisp ★ Powered by Deep Neural Networks Krisp uses Deep Neural Networks to detect background noise and remove it from your voice stream in real-time

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium7

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.6 Code review	12

Extension Version	Code Review Findings
1.1.6	12

Files with findings

4 distinct paths — top paths by unique finding count:

static/js/background.js5
static/js/patch.js4
static/js/content.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	static/js/content.js (line 278)	The content script dynamically injects patch.js directly into the page's main world (not the isolated content script context) by prepending a script element to document.head. This bypasses Chrome's content script isol…	1.1.6
2	Credential Theft	high	static/js/background.js (line 4028)	The background page defines a generic helper that executes arbitrary code in a tab to read `localStorage` entries. Elsewhere this helper is used to fetch the `auth` and `account` keys from a Krisp web tab, which is ef…	1.1.6
3	Network Interception	high	static/js/patch.js (line 125)	The patch.js script replaces all three variants of getUserMedia (modern, legacy webkit, and legacy navigator) with its own interceptor methods on every page it is injected into. While declared as noise cancellation, t…	1.1.6
4	Other	high	static/js/patch.js (line 156)	This code monkey-patches `navigator.mediaDevices.getUserMedia` and legacy microphone APIs in the page context. Overriding native media-capture functions across third-party pages is a high-risk pattern because it lets …	1.1.6
5	Code Injection	medium	static/js/content.js (line 276)	The content script injects an extension-provided page-context script (`patch.js`) directly into visited sites. Because the extension is registered on nearly all HTTP(S) pages at `document_start`, this gives the extens…	1.1.6
6	Data Exfiltration	medium	static/js/background.js (line 4112)	The analytics module accumulates events including install ID, user ID, extension version, timestamps, and call-end events containing site origins and mic names, then batches and POSTs them to https://analytics.krisp.a…	1.1.6
7	Data Exfiltration	medium	static/js/background.js (line 4139)	Queued analytics events are transmitted to the remote analytics backend via `f.post("store", t)`. Combined with the event-building code, this means the extension exports detailed usage and call metadata off-device, wh…	1.1.6
8	Privilege Escalation	medium	manifest.json (line 22)	The content script is declared to run at document_start on every HTTP and HTTPS page (http:///, https:///) including about:blank frames. Running at document_start means the script executes before any page content …	1.1.6
9	Tracking	medium	static/js/background.js (line 3621)	The background script systematically collects per-tab call analytics including the site origin (hostname/URL), tab title, favicon URL, microphone device label, stream duration, and audio sample rate for every active m…	1.1.6
10	Unauthorized Data Collection	medium	static/js/patch.js (line 191)	Every second while a microphone stream is active, this function dispatches a custom DOM event containing the microphone device label, audio context timing, latency, state, and sample rate. Even when the user is not si…	1.1.6
11	Unauthorized Data Collection	medium	static/js/patch.js (line 193)	After hooking microphone access, the injected script packages runtime audio metadata including the device label (`micName`) and sample rate, then emits it back toward the extension. This is a suspicious collection pat…	1.1.6
12	Tracking	low	static/js/background.js (line 3998)	On installation/startup the extension sends a telemetry payload containing a persistent installation ID, timezone, locale, full user agent, and CPU model. This is device fingerprinting-style collection that expands th…	1.1.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


krisp.ai	/terms-of-use.	https://krisp.ai/terms-of-use.
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
github.com	/crypto-browserify/crypto-browserify	https://github.com/crypto-browserify/crypto-browserify
registry.npmjs.org	/elliptic/-/elliptic-6.5.2.tgz	https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz
github.com	/indutny/elliptic/issues	https://github.com/indutny/elliptic/issues
github.com	/indutny/elliptic	https://github.com/indutny/elliptic
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.3.132.0	IPv4	-
1.101.3.4	IPv4	-

2.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Oof, thank God, Krisp did not delete the app. Yet

Samuel Perou·12 Nov 2020

No la recomiendo. La versión de escritorio no la pude instalar porque solo es compatible con Windows 10. Utilicé la extensión y mis alumnos reportaban problemas con el audio, al apagar la extensión me escuchaban perfecto; realicé pruebas con familiares y amigos y todos coinciden en que prefieren escuchar el ruido normal, al ruido distorsionado que se crea con la extensión.

Claudia Martínez·16 Oct 2020

Every time I turn on the App, people that I am talking to cannot hear me clearly. My voice is breaking up in and out. I feel disappointed, because I thought this app can help but it even makes it worse.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Krisp for Chrome

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating