Chrome Web StoreCaution required
Suspicious in code review (v1.2.0)
Our reviewer found behaviour consistent with malware in version 1.2.0, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
LXX DAO Extension is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by other. It comes from a trusted publisher and was last updated in October 2026.
Key findings
- High
Other
The bundled manifest declares `webNavigation` and `sidePanel` permissions that are entirely absent from the CWS-published manifest summary. `webNavigation` enables monitoring all browser navigation events and is actively used in to intercept Transak and Alchemy redirects; its omission from the published listing means users and Google reviewers were not shown the full permission surface. Per the analysis instructions, a mismatch between bundled and published permissions is itself a high-severity finding.
- High
Code Injection
When the user visits [domain withheld] (a third-party crypto sell ramp), the extension injects JavaScript to scan the entire page DOM — including all attributes, input values, and text nodes — to extract crypto deposit addresses, then forcibly closes the Alchemy tab before the user can interact with it, and redirects the user to the extension's own popup. This pattern creates an address-substitution attack surface: the extension controls both the scraped address and the subsequent UI shown to the user. The React app's main bundle (not included in this analysis package) could substitute a different address at the point of display. The behavior is plausibly legitimate for a wallet sell-flow automation, but the forced tab closure combined with a publisher that has 46% malicious extension rate significantly elevates the risk.
Analyst notes
The source code follows standard Web3 wallet architecture (MetaMask-style JSON-RPC bridge, inpage provider injection, transaction signing popups) and the eval() usages are explicitly for Buffer polyfilling — benign. However, two concrete concerns elevate the verdict: (1) the bundled manifest declares `webNavigation` and `sidePanel` permissions absent from the published CWS listing, a genuine mismatch the instructions treat as a high-severity finding; (2) forcibly closes third-party [domain withheld] tabs after scraping the crypto deposit address via `chrome.scripting.executeScript`, then opens the extension's own popup — this pattern could faithfully automate a sell flow, but without the React app's (not included in this bundle), we cannot confirm the scraped address is used unmodified rather than substituted with an attacker address. The publisher signal ([domain withheld], 46% malicious across 295 extensions, branding mismatch with [domain withheld]) strongly corroborates suspicion and raises the likelihood of a future malicious update; it does not alone establish current malice.
LXX DAO Extension Chrome extension security report
ID: ogbdflabaoemndngioedpedkcieinfca
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- admin
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- ES
- Address
- Avenida medico antonio alonso 7 Churriana de la vega, Granada 18194 ES
- Website
- Visit
Screenshots & videos
Install growth
No Security Analysis Available
Security analysis has not been performed for this extension version yet.
About this extension
Connect to Web3 and manage your crypto securely across multiple blockchains—all in one self-custodial wallet.
Read the publisher’s full description
Take full control of your digital assets with the LXX DAO Extension — a secure, self-custodial browser wallet built for seamless interaction with Web3. LXX DAO Extension allows you to manage your cryptocurrencies, NFTs, and decentralized applications (dApps) through a single, intuitive interface. Whether you're sending assets, exploring decentralized finance, or connecting to dApps, the extension provides a smooth and secure experience while ensuring you remain in full control of your private keys. Key Features Multi-Wallet Management Create and manage multiple wallets within one extension for better organization and flexibility. Asset Management Easily send, receive, and manage your digital assets with secure and reliable transaction handling. Buy & Sell Crypto Access integrated services to conveniently purchase or sell cryptocurrencies. Token Swaps Swap supported tokens directly within the extension without switching platforms. Cross-Chain Transfers Move assets across supported networks with a streamlined experience. NFT Support Store, send, and manage your NFTs alongside your crypto assets. Wallet Import Securely import existing wallets using private keys or recovery phrases. Hardware Wallet Support Enhance security by connecting your hardware wallet. Sub-Accounts Organize funds and activities using multiple sub-accounts within a single wallet. dApp Connectivity Connect and interact with decentralized applications directly from your browser. Security & Control Self-custodial wallet — you control your private keys and funds Secure transaction signing Privacy-focused design Optional hardware wallet integration Why Choose LXX DAO Extension? All-in-one Web3 wallet experience Clean and intuitive interface Suitable for both beginners and advanced users Built with a strong focus on security and usability Get Started Install the LXX DAO Extension to securely manage your digital assets and explore Web3 directly from your browser.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from admin
- Safe3 safe browsing1,000,000 users
- Youtube zero ads129,950 users
- HTML5 Video Playback Speed Control119,148 users
- SkipAds for Youtube104,615 users
- Full Free Video Downloader79,006 users
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持85,000,000 users
- Claude20,000,000 users
- ApexGuard VPN Proxy for Chrome10,000,000 users
- Tenelk VPN10,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.