Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: LetMeWatch

CRITICAL RISKRemoved from Chrome Web Store

LetMeWatch

ID: lalbidfnmdmafompodhbmppbpakipaah

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.91

Size

32.58 MB

Rating

4.6/5

Reviews

Users

5,901

Type

Extension

Updated

Sep 10, 2022

Publisher Contextual Analysis

Trusted

Author: http://letmewatch.appView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,901

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

LetMeWatch: A seamless watching experience in a Chrome extension.

✔ All your favorite movies and TV Shows, only a few clicks away ✔ More titles than Netflix, Hulu, Disney+, or HBOMax ✔ Unlimited HD-quality content at your fingertips ✔ Absolutely free, forever ------------------------------------------- LetMeWatch is a Google Chrome extension that offers end-to-end movie/TV show streaming, maximizing ease of use and convenience by sifting through a multitude of free streaming services and locating the highest-caliber video that is available.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+10.15%(+544 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 31 ratings+1 (3%)

Average Rating

Current: 4.61 / 5.0-0.01

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium5

Low0

Versions scanned

Showing 1 of 20 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.74 Code review	8

Extension Version	Code Review Findings
1.74	8

Files with findings

5 distinct paths — top paths by unique finding count:

js/popup.js4
js/thankYou.js1
js/third-party/analytics.js1
js/viewPage.js1
viewPage.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	high	js/popup.js (line 171)	When a user selects a movie, the extension constructs a URL pointing to `2embed.ru`, a known piracy streaming aggregator that serves copyrighted content without authorization, and stores it in localStorage. The commen…	1.74
2	Other	high	js/popup.js (line 737)	Same piracy-redirect pattern for TV episodes: every episode click routes the user to 2embed.ru with the IMDB ID, season, and episode number. User watch history including IMDB IDs, season, and episode data is also writ…	1.74
3	Remote Code Loading	high	viewPage.html (line 13)	The viewing page is an edge-to-edge full-screen iframe with z-index 999999 that completely takes over the browser tab. Its `src` is set at runtime from `localStorage.getItem('vidUrl')` (a 2embed.ru URL). This gives th…	1.74
4	Remote Code Loading	medium	js/viewPage.js (line 1)	The iframe source is loaded directly from `localStorage` with no validation or allowlist check. Any script that can write to `localStorage` (e.g., via XSS in an extension page) could redirect the iframe to an arbitrar…	1.74
5	Tracking	medium	js/popup.js (line 1)	The extension initializes Google Analytics (UA-208644341-1) and deliberately nulls out `checkProtocolTask` to disable GA's built-in safety check that prevents tracking from non-HTTP origins. This is a known technique …	1.74
6	Tracking	medium	js/thankYou.js (line 1)	Identical protocol-bypass tracking pattern repeated on the post-install thank-you page, confirming the analytics collection is deliberate and applies across multiple extension pages. Every installation triggers a `/th…	1.74
7	Tracking	medium	js/third-party/analytics.js (line 1)	The Google Analytics analytics.js library is bundled locally inside the extension package rather than loaded from Google's CDN. Chrome extension CSP would normally block loading external scripts from google-analytics.…	1.74
8	Unauthorized Data Collection	medium	js/popup.js (line 19)	Four third-party API keys are hardcoded in plaintext and shipped to all 5,900+ users: IMDB (imdb-api.com), OMDB, TMDB, and SportsData.io NFL keys. Any user who inspects the extension source can extract and abuse these…	1.74

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

917

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.googleapis.com	-	https://fonts.googleapis.com
fonts.gstatic.com	-	https://fonts.gstatic.com
cdnjs.cloudflare.com	/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Lato:wght@300;400;700;900&family=Montserrat:wght@200;300;400;500;600;700;800;900&family=Noto+Sans+JP:wght@300;400;500;700;900&family=Open+Sans:wght@300;400;600;700;800&family=Poppins:wght@200;300;400;500;600;700;800;900&family=Roboto:wght@300;400;500;700;900&display=swap
github.com	/easylist/easylist/commit/6295313	https://github.com/easylist/easylist/commit/6295313
github.com	/easylist/easylist/issues/5054	https://github.com/easylist/easylist/issues/5054
github.com	/NanoMeow/QuickReports/issues/198	https://github.com/NanoMeow/QuickReports/issues/198
github.com	/uBlockOrigin/uAssets/issues/2364	https://github.com/uBlockOrigin/uAssets/issues/2364
github.com	/uBlockOrigin/uAssets/issues/227	https://github.com/uBlockOrigin/uAssets/issues/227
www.jmbullion.com	/gold/	https://www.jmbullion.com/gold/

Showing 1 to 10 of 920 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


23.109.87.42	IPv4	-
167.99.31.227	IPv4	-
23.109.87.101	IPv4	-
35.232.188.118	IPv4	-
37.1.209.213	IPv4	-
51.77.227.100	IPv4	-
51.77.227.101	IPv4	-
51.77.227.102	IPv4	-
51.77.227.103	IPv4	-
51.77.227.96	IPv4	-
51.77.227.97	IPv4	-
51.77.227.98	IPv4	-
51.77.227.99	IPv4	-
51.89.187.136	IPv4	-
51.89.187.137	IPv4	-
51.89.187.138	IPv4	-
51.89.187.139	IPv4	-
51.89.187.140	IPv4	-
51.89.187.141	IPv4	-
51.89.187.142	IPv4	-
51.89.187.143	IPv4	-
167.206.10.148	IPv4	-
142.91.159.107	IPv4	-
146.59.223.83	IPv4	-
176.31.68.242	IPv4	-
185.147.34.126	IPv4	-
23.109.150.101	IPv4	-
23.109.248.149	IPv4	-
23.109.248.159	IPv4	-
23.109.82.104	IPv4	-
23.109.82.74	IPv4	-
5.45.79.15	IPv4	-
51.178.195.171	IPv4	-
51.195.115.102	IPv4	-
51.89.115.13	IPv4	-
146.59.211.227	IPv4	-

Showing 1 to 36 of 40 rows

Rows per page:

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

i'm surprised to have found such nifty awesome extension like this ty!

Meg·26 Dec 2022

The quality varies, as should be expected given the stated methodology, and there are issues with the player sometimes (once I found the extension either couldn't find the show I wanted to watch or it recognised the show but couldn't find any videos of it, can't remember which but I'm leaning towards the latter) but this still arguably the best way of watching shows/movies.

Baba·11 Dec 2022

Please fix the page size of this extension for "vidsrc", "dbgo" and "trailers.to" In chrome, VIDSRC page dimension has top = -50px. Please set it to 0px.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

LetMeWatch

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 20 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating