Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Multi-highlight

CRITICAL RISKRemoved from Chrome Web Store

Multi-highlight

ID: dhllbfnggenplegmhcgcjglencnapicd

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0

Size

0.08 MB

Rating

1.0/5

Reviews

Users

151,264

Type

Extension

Updated

Nov 30, 2020

Publisher Contextual Analysis

Author: franczgs18View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

151,264

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Search and highlight multiple words on web pages.

Multi highlight extension is the best highlighter you`ll ever find. This chrome application allows you to search and highlight multiple words on any webpage. All you need to do is click on extension icon in right upper corner and write the words you need to be highlighted (separated by a space). Every word you write will be highlighted on a chosen webpage and will have different color. Generally, this extension is pretty simple, bur really useful. Multi highlight is absolutely free and doesn`t weigh a lot. Help us to improve the extension and leave your requests and comments.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium2

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	7

Extension Version	Code Review Findings
1.0	7

Files with findings

3 distinct paths — top paths by unique finding count:

backser.js5
app/less/libster.js1
app/less/onpage.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Obfuscation	critical	backser.js (line 1)	The entire background script uses extreme systematic obfuscation: every variable, function, and constant is given a nonsensical pseudo-word name (e.g., `hydroGrapher`, `myxothallophyta`, `galliform`, `colon_itis`, `re…	1.0
2	Privilege Escalation	critical	backser.js (line 197)	The `arzava` function implements a generic RPC dispatcher: any content script or web page (via `chrome.runtime.sendMessage`) can send `{opt: "rpc", func: "<anyFunctionName>", args: [...]}` and the background will call…	1.0
3	Code Injection	high	backser.js (line 60)	On every `install` event, the extension enumerates all open windows and tabs and programmatically injects its JavaScript files and CSS into each tab via `chrome.tabs.executeScript` and `chrome.tabs.insertCSS`. This co…	1.0
4	Tracking	high	backser.js (line 27)	The extension explicitly defines `USER_ID_STORE = "userUUID"` and persists all data — including this UUID — to `chrome.storage.sync`, which syncs across all of a user's Chrome profiles. A unique UUID per user combined…	1.0
5	Other	medium	backser.js (line 182)	The background page exposes a generic string-based RPC bridge that dispatches any requested function name from incoming messages. In isolation this does not prove exploitation, but it is a risky design because it weak…	1.0
6	Unauthorized Data Collection	medium	app/less/onpage.js (line 58)	The content script uses `DOMSubtreeModified` — a deprecated but still-functional event that fires on every single DOM mutation on every page — to continuously trigger re-processing of page content. Combined with the `…	1.0
7	Code Injection	low	app/less/libster.js (line 215)	The `defalcatIng` function assigns raw page text content to `macroglossate.innerHTML` rather than `textContent`. While the value originates from `nodeValue` (page text), using `innerHTML` for DOM injection instead of …	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Multi-highlight

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating