Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Map Search for Chrome™

CRITICAL RISKRemoved from Chrome Web Store

Map Search for Chrome™

ID: hpdpddnfjaacnbcnoohlcipfafkbmdja

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.2202.0

Size

0.21 MB

Rating

0.0/5

Reviews

Users

8,000

Type

Extension

Updated

Jun 21, 2024

Publisher Contextual Analysis

Trusted

Author: https://thesqout.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

538,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Easily search for any location and get instant, detailed map results!

Map Search for Chrome™ is convenient and user-friendly. Effortlessly searches locations by simply typing the your desired location in the search bar and clicking on the "Map Search" option in the search suggestion dropdown. Receive results displayed directly on maps, enriched with a plethora of relevant information. Whether looking for nearby restaurants, tourist attractions, or local businesses, Map Search presents comprehensive details at your fingertips. This extension automatically switches the default search engine to Bing for a seamless searching experience. The extension also allows you to switch between Bing, Yahoo, and Google in the popup and will work with any of these search engines. If you have any issues, contact us at [email protected].

User Growth

Showing data from May 14, 2025 to Aug 10, 2025

Versions

-22.22%(-2,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High7

Medium1

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2202.0 Code review	13

Extension Version	Code Review Findings
1.0.2202.0	13

Files with findings

2 distinct paths — top paths by unique finding count:

bg.js12
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	bg.js (line 2598)	Function `L` is injected into web pages via chrome.scripting.executeScript and exposes a postMessage-based command channel that lets a remote iframe arbitrarily create DOM nodes from attacker-supplied innerHTML (`ce`)…	1.0.2202.0
2	Credential Theft	critical	bg.js (line 2663)	Inside the injected content script, the `sel` handler attaches an arbitrary DOM event listener (name and target object selected by attacker-supplied `t.path` walking the page's `window` object) and serializes every fi…	1.0.2202.0
3	Data Exfiltration	critical	bg.js (line 2701)	The `dg` handler walks the page's `window` object along an attacker-supplied dotted path (`S(window, t.path)`) and JSON-serializes the result back to the remote operator. Combined with `gea`/`sea` (read/write any attr…	1.0.2202.0
4	Remote Code Loading	critical	bg.js (line 2823)	After defining the message-driven DOM RPC handlers, the injected script appends an iframe whose `src` (parameter `t`) is supplied by the extension's background script — ultimately a URL controlled by the extension's r…	1.0.2202.0
5	Network Interception	high	bg.js (line 4955)	A webRequest.onSendHeaders listener (registered with `<all_urls>` and `requestHeaders`/`extraHeaders`) extracts the Referer header from every outgoing HTTP request and caches it keyed by request id and tab id. Capturi…	1.0.2202.0
6	Network Interception	high	bg.js (line 6222)	The background script subscribes to the full lifecycle of every request on every URL — onBeforeRequest, onBeforeRedirect, onResponseStarted, onCompleted, onErrorOccurred, onSendHeaders — over `<all_urls>` for `main_fr…	1.0.2202.0
7	Obfuscation	high	bg.js (line 2158)	Outbound JSON payloads are XOR-encoded with a single byte key (`d` = 255 from module 2: `var d = p.v ? p.v : 255`) and base64-wrapped, then transmitted with content-type `application/x-binary` instead of application/j…	1.0.2202.0
8	Privilege Escalation	high	bg.js (line 2560)	Generic wrapper that injects an arbitrary function (`r`) with arbitrary args (`n`) into any tab via chrome.scripting.executeScript. It is the delivery mechanism that places the iframe-RPC content script (function `L` …	1.0.2202.0
9	Tracking	high	bg.js (line 7497)	Uses chrome.cookies.set to write cookies on arbitrary domains with maximum expiration (year-2038 timestamp) and `sameSite: 'no_restriction'`. Combined with `<all_urls>` host permissions, this writes long-lived cross-s…	1.0.2202.0
10	Tracking	high	manifest.json (line 11)	Hijacks the browser's default search provider and search-suggestions endpoint to attacker-controlled domains (search.searchsqout.com / ext.searchsqout.com). Every search query and keystroke in the address bar is now r…	1.0.2202.0
11	Unauthorized Data Collection	high	bg.js (line 1694)	Every server hit bundles a fingerprint of the user/device: navigator.language, local timezone offset, persistent UUID (`id`), chrome.runtime.id, manifest version, full chrome.storage.local snapshot, the active tab id,…	1.0.2202.0
12	Tracking	medium	bg.js (line 2122)	All telemetry/event POSTs use `credentials: 'include'`, sending the user's cookies for the destination domain (ext.searchsqout.com / ext.sqouterr.com) on every transmission. Combined with the host permission `<all_url…	1.0.2202.0
13	Tracking	low	bg.js (line 9817)	Sets a chrome.runtime.setUninstallURL pointing at `<api-base>/api/sq/uninstall?eid=<extension_id>` so the operator's server is notified (and can fingerprint) every uninstall event. This is benign in isolation but here…	1.0.2202.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


searchsqout.com	-	https://searchsqout.com
thesqout.com	-	https://thesqout.com
ext.searchsqout.com	-	https://ext.searchsqout.com
ext.sqouterr.com	-	https://ext.sqouterr.com
thesqout.com	/feedback.html	https://thesqout.com/feedback.html
unknow.com	-	http://unknow.com
www.bing.com	/maps	https://www.bing.com/maps?q=
ext.searchsqout.com	/src/bg.js.54a6017d9e97d8387f56.map	https://ext.searchsqout.com/src/bg.js.54a6017d9e97d8387f56.map
cdn.searchsqout.com	/ext/bg_1718889448.png	https://cdn.searchsqout.com/ext/bg_1718889448.png
ext.searchsqout.com	/src/style.css.54a6017d9e97d8387f56.map*/	https://ext.searchsqout.com/src/style.css.54a6017d9e97d8387f56.map*/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Map Search for Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating