Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Домашняя страница Mail.Ru

CRITICAL RISKRemoved from Chrome Web Store

Домашняя страница Mail.Ru

ID: mgpdmkkhjffhfkbpeigghejkngiaaike

Could be malicious

Extension Info & Metadata

Status

Removed

Version

15.1.13.8

Size

0.06 MB

Rating

4.5/5

Reviews

216

Users

478,698

Type

Extension

Updated

Nov 27, 2018

Publisher Contextual Analysis

Author: http://mail.ruView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

496,196

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Быстрый переход на популярные сервисы от Mail.Ru

Домашняя страница Mail.Ru Быстрый переход на популярные сервисы от Mail.Ru Устанавливая программу, вы принимаете условия Лицензионного соглашения https://help.mail.ru/legal/exts-eula

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium3

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
15.1.13.8 Code review	7

Extension Version	Code Review Findings
15.1.13.8	7

Files with findings

1 distinct path — top paths by unique finding count:

background.js7

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	background.js (line 1)	The extension communicates with a native host binary (`ru.mail.go.ext_info_host`) via `chrome.runtime.sendNativeMessage`, sending the extension ID and receiving `InstallData`. Native messaging breaks out of the browse…	15.1.13.8
2	Data Exfiltration	high	background.js (line 1)	The extension sends JavaScript stack traces, Chrome API error details (including the API method name and `chrome.runtime.lastError`), and bookmark error messages to `http://mrds.mail.ru/update/2/version.txt` via plain…	15.1.13.8
3	Unauthorized Data Collection	high	background.js (line 1)	The extension uses the `cookies` permission to both read (`CookieDataGenerator`) and write (`LongTermCookiePlugin`, with a 7-day expiry) cookies on `inline.go.mail.ru`. The short-term cookie (`go_install_data_default`…	15.1.13.8
4	Data Exfiltration	medium	background.js (line 1)	All telemetry and metric data (errors, state, version info, extension ID) is transmitted to `http://mrds.mail.ru/` and `http://go.mail.ru/` over plaintext HTTP rather than HTTPS. This makes all transmitted data visibl…	15.1.13.8
5	Tracking	medium	background.js (line 1)	The extension fetches a tracking pixel from `https://ad.mail.ru/i1555.gif` via `PixelFetcherPlugin`. Ad-network tracking pixels are used to record that the extension is installed, associate the browser with an adverti…	15.1.13.8
6	Unauthorized Data Collection	medium	background.js (line 1)	On install and every browser startup, the extension reads the user's current homepage URL via `browser.browserSettings.homepageOverride.get()` and extracts the hostname, sending it as metric parameters (`ovr.hp.top.ho…	15.1.13.8
7	Tracking	low	background.js (line 1)	The extension registers an `UninstallUrlPlugin` that writes a uniquely-generated cookie (`uninstall_<uuid>`) and sets an uninstall URL pointing to `https://data.browser.mail.ru/newtab/uninstall.html`. This allows the …	15.1.13.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


mrds.mail.ru	/update/2/version.txt	http://mrds.mail.ru/update/2/version.txt?
mail.ru	-	https://mail.ru
inline.go.mail.ru	-	https://inline.go.mail.ru
data.browser.mail.ru	/newtab/uninstall.html	https://data.browser.mail.ru/newtab/uninstall.html
mrds.mail.ru	/update/2/version.txt	http://mrds.mail.ru/update/2/version.txt
go.mail.ru	/distib/mark/	http://go.mail.ru/distib/mark/
ad.mail.ru	/$%7Bt%7D.gif%60	https://ad.mail.ru/${t}.gif`
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
inline.go.mail.ru	/homepage	https://inline.go.mail.ru/homepage?inline_comp=chhp15.1.13.8&inline_hp_cnt=21071633
*.mail.ru	/*	http://.mail.ru/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


15.1.13.8	IPv4	-

2.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Вообще не работает! Пустой значок висит на панели браузера и все! Параметры расширения не высветливаются. И сообщает, что "незможно прочитать или установить параметры сайта". Чушь! Удаляю...

Dominika Callistos·24 Jul 2020

посмотрим

ЖШ

Жахонгир Шукуров·23 Jun 2020

Отличная стартовая страница

Denis Gamazov·5 Feb 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Домашняя страница Mail.Ru

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews