Chrome Web Store
2Versions
1Code reviewed

Caution required

Suspicious in code review

Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.

Matchventures Game - Embark on a Magical Match-3 Adventure!

Matchventures Game - Embark on a Magical Match-3 Adventure!

ID: lclmfacdjajnpmommpcjobpbhefhjhkf

Supported Languages

🇸🇦Arabic
🇧🇷Brazilian Portuguese
🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇨🇿Czech
🇳🇱Dutch
🇺🇸English
🇫🇮Finnish
🇫🇷French
🇩🇪German
🇬🇷Greek
🇮🇹Italian
🇯🇵Japanese
🇰🇷Korean
🇳🇴Norwegian
🇵🇱Polish
🇵🇹Portuguese
🇷🇸Serbian
🇸🇰Slovak
🇪🇸Spanish
🇸🇪Swedish
🇹🇭Thai
🇹🇷Turkish

Extension Info & Metadata

Status
Active
Version
1.0.5
Size
46.22 MB
Rating
0.0/5
Reviews
0
Users
9
Type
Extension
Updated
Mar 26, 2025
Category
Games
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

This publisher

19 extensions, 10 no longer listed on the store

Publisher Contextual Analysis

Author
vigilidelfonso91View Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
19
Active
9
Obsolete
10
Listed
19
Unlisted
0
Total Users
1,212

This extension requests no permissions and has no recorded risk factors.

The extension fetches a remote JSON payload from `game-extension-api.offlinegames.fun` and injects the server-returned URLs as iframe `src` attributes directly via `innerHTML` with no URL validation or allowlist. The operator can update the response at any time to load any URL — including phishing pages, ad networks, or pages that exploit postMessage — inside the extension's page without updating the extension itself. This is a classic remote-control pattern used by adware and PUP extensions.

js/game.js (Line 96)
try {  const response = await fetch('https://game-extension-api.offlinegames.fun/recommend/');  const data = await response.json();  if (!data.enable) {    return;  }  const recommendBox1 = document.querySelector('.recommend-box-1');  const recommendBox2 = document.querySelector('.recommend-box-2');  if (data['recommend-1']) {    recommendBox1.innerHTML = `<iframe src="${data['recommend-1']}" width="100%" height="100%"></iframe>`;    recommendBox1.style.display = 'block';  }  if (data['recommend-2']) {    recommendBox2.innerHTML = `<iframe src="${data['recommend-2']}" width="100%" height="100%"></iframe>`;    recommendBox2.style.display = 'block';  }} catch (err) {}

By severity

Critical0
High1
Medium0
Low0

Versions scanned

None of the 2 scanned versions have more than one unique code-review finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
No versions with multiple unique findings.

Files with findings

1 distinct path — top paths by unique finding count:

  • js/game.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Remote Code Loading
high
js/game.js (line 96)The extension fetches a remote JSON payload from `game-extension-api.offlinegames.fun` and injects the server-returned URLs as iframe `src` attributes directly via `innerHTML` with no URL validation or allowlist. The …
URLs
41
IPv4
3

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

chilliant.blogspot.com.au/2012/08/srgb-aG%EF%BF%BD%EF%BF%BD-for-%EF%BF%BD(%EF%BF%BDX.htmlhttp://chilliant.blogspot.com.au/2012/08/srgb-aG��-for-�(�X.html?m=1{xbsRGB
http:-http://www.a��.com/type/Q#lQal.@?mle
bugzilla.mozilla.org/show_bug.cgihttps://bugzilla.mozilla.org/show_bug.cgi?id=1670675
web-platform.bytebrew.io/api/game/configurations/remote/https://web-platform.bytebrew.io/api/game/configurations/remote/
web-platform.bytebrew.io/api/game/logs/addhttps://web-platform.bytebrew.io/api/game/logs/add
bugzilla.mozilla.org/show_bug.cgihttps://bugzilla.mozilla.org/show_bug.cgi?id=1397977
github.com/kripken/emscripten/wiki/WebAssemblyhttps://github.com/kripken/emscripten/wiki/WebAssembly#binaryen-methods
github.com/kripken/emscripten/wiki/Linkinghttps://github.com/kripken/emscripten/wiki/Linking
i.poki.com/q80,w100,h100,g29251,Default.jpghttps://i.poki.com/q80,w100,h100,g29251,Default.jpg
github.com/webpack-contrib/style-loaderhttps://github.com/webpack-contrib/style-loader#insertat
Showing 1 to 10 of 50 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

127.0.0.1
IPv4
-
0.0.0.0
IPv4
-
0.0.0.1
IPv4
-
Version
Size
Verdict
Findings
Permhash
1.0.5
Latest
46.22 MBCaution1N/A
1.0.4
46.22 MBCautionN/A
Showing 1 to 2 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

About this extension

Join the magical journey of Matchventures—an offline match-3 adventure in your browser!

Read the publisher’s full description

Matchventures: Free Puzzle Adventure Browser Extension Game 🌟 Embark on a magical journey with Matchventures, a charming browser extension game that blends match-3 puzzles with adventure-driven storytelling! 🧩✨ Play offline anytime, anywhere—no downloads or installations required. Simply add the extension to your browser and dive into a vibrant world filled with challenges, treasures, and adorable characters. Key Features: 🌴 Match-3 Meets Adventure: Swap and match colorful blocks to solve puzzles, unlock hidden paths, and progress through enchanting realms like mystical forests, ancient ruins, and tropical islands. Every match brings you closer to uncovering secrets! ⚡️ Offline Play & Free Forever: Enjoy uninterrupted gameplay even without an internet connection. Perfect for quick breaks or long journeys. And yes—it’s 100% free with no paywalls! 🏆 Progression & Customization: Collect coins, gems, and power-ups to upgrade your tools, unlock special abilities, and customize your hero’s appearance. Build your dream village by solving puzzles and completing quests. 🤝 Social Collaboration: Team up with friends (anonymously or via nicknames) to tackle tough levels, share boosts, and compete in friendly leaderboards. Earn bragging rights as you climb the ranks! 🎨 Engaging Challenges: Daily puzzles, timed events, and boss battles keep the excitement fresh. Master combo chains and strategic moves to earn bonus rewards! 🔮 Dynamic World: Discover ever-expanding content with regular updates—new levels, seasonal events, and exclusive rewards await. Perfect for casual gamers and puzzle enthusiasts alike, Matchventures offers a seamless blend of relaxing gameplay and strategic depth. Whether you’re decorating your village, battling obstacles, or hunting for hidden treasures, every match brings a new adventure. Ready to test your skills? Install now and start your puzzle quest today—no sign-up required! 🚀 We provide a "Play More Games" button in the extension and open our official website when you first install it, where you can experience more free games.

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4

Install growth

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.