Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Mailto-venster

CRITICAL RISKRemoved from Chrome Web Store

Mailto-venster

ID: mopkbocbdopiojecoghimklobpokfifk

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1

Size

0.03 MB

Rating

1.8/5

Reviews

Users

172,376

Type

Extension

Updated

Dec 3, 2019

Publisher Contextual Analysis

Author: mailto-venster.comView Profile

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

172,376

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Gebruik of kopieer een e-mailadres

Bent u het beu dat uw standaard elektronische berichtensysteem opent wanneer u klikt op een e-mailadres? Het Mailto-venster is de meest efficiënte methode om deze automatische opening te vermijden! Vereenvoudig het verzenden van e-mailberichten en kopiëren van e-mailadressen met het Mailto-venster. Wanneer u klikt op een e-mailadres opent onze plugin een pop-upvenster dat u de mogelijkheid biedt om: - uw adres te kopiëren op het klembord - (of) dit adres te gebruiken in uw elektronische berichtensysteem (standaard) U kunt de laatste 5 e-mailadressen die u gebruikt hebt gemakkelijk terugvinden in de Mailto-geschiedenis, rechtsboven in uw browser. U kunt er op elk moment op klikken om een e-mailadres terug te vinden dat u hebt gebruikt of gekopieerd met het Mailto-venster. Als u de plugin hebt geïnstalleerd, is deze actief op alle pagina’s van uw browser. Klik op een e-mailadres om het Mailto-venster weer te geven. Het Mailto-venster slaat geen enkele van uw persoonsgegevens op en deelt ze met niemand. Als u deze plugin installeert, verklaart u zich akkoord met het hiernaast vermelde privacybeleid https://www.mailto-venster.com/info/privacy-policies.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium3

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1 Code review	6

Extension Version	Code Review Findings
1.1	6

Files with findings

2 distinct paths — top paths by unique finding count:

toMailContentScript.js5
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	toMailContentScript.js (line 70)	The content script reads a value from the current page's `localStorage` under the key `mailtopopup`, decodes it from base64 using `atob()`, and then injects it as raw `innerHTML` into every page the user visits. Any w…	1.1
2	Tracking	high	toMailContentScript.js (line 107)	The extension provides a `toMailSetCookie` function that writes cookies to any page it runs on, covering all URLs due to the `<all_urls>` manifest match. Combined with the `innerHTML` injection vector (finding 1), thi…	1.1
3	Unauthorized Data Collection	high	toMailContentScript.js (line 12)	The content script includes a full cookie-reading function (`toMailGetCookie`) that parses `document.cookie` on every page it is injected into. Because the manifest declares `matches: ["<all_urls>"]` with `all_frames:…	1.1
4	Other	medium	manifest.json (line 33)	The extension injects its content script into every frame on every URL. This is an unusually broad execution scope for a mailto helper and materially enlarges the attack surface for any data collection or DOM manipula…	1.1
5	Unauthorized Data Collection	medium	toMailContentScript.js (line 59)	A click handler is attached directly to `document.body` on every page across all URLs and all frames. Every user click is inspected and email addresses extracted from clicked `mailto:` links are captured and stored pe…	1.1
6	Unauthorized Data Collection	medium	toMailContentScript.js (line 113)	The extension records every clicked `mailto:` address into `chrome.storage.sync`, which can sync the collected addresses to the user's signed-in Chrome profile. Retaining email targets from arbitrary websites is a for…	1.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.mailto-venster.com	/info/success	https://www.mailto-venster.com/info/success
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

Add spammy links to search results. No idea how this extension was installed.

Dita Verheij·25 Dec 2020

It is not known how this extension is installed (where does it come from?). That in itself is very strange. Furthermore, this extension adjusts your browser screen so that clicking on a link or a selection list in a popup no longer works.

Ge Ba·30 Oct 2020

Adware, adds advertisements to your google search results.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Mailto-venster

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews