MySocialShortcut

ID: dffodcokjhgglfakabaogimnpblkhdjj

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese
🇳🇱Dutch
🇺🇸English
🇫🇷French
🇩🇪German
🇮🇹Italian
🇯🇵Japanese
🇰🇷Korean
🇲🇽Latin American Spanish
🇵🇹Portuguese
🇪🇸Spanish

Extension Info & Metadata

Status
Removed
Version
13.962.19.39225
Size
0.38 MB
Rating
4.0/5
Reviews
23
Users
330,991
Type
Extension
Updated
Apr 14, 2021
Category
1_communication
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
http://mysocialshortcut.comView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
2
Active
0
Obsolete
2
Listed
2
Unlisted
0
Total Users
1,015,632

Find the best, FREE way to access your social networks with this Chrome New Tab Extension.

Discover the easy way to access your social media networks, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested : "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Log: 13.962 : Optimizes the sync of this extension between Chrome profiles.

Item
Type
Severity
Description
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
management
Permission
Medium
This permission manages other installed extensions. Rated Medium because it can enable/disable other extensions and modify their settings, with changes being visible to users.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
*://anx.tb.ask.com/*
Permission
Unknown
No classification available for this permission.
*://live.tb.ask.com/*
Permission
Unknown
No classification available for this permission.
*://*.mysocialshortcut.com/*
Permission
Unknown
No classification available for this permission.
*://hp.myway.com/*
Permission
Unknown
No classification available for this permission.

This code executes arbitrary JavaScript stored in `_this.remoteScript` directly into the active tab at `document_start`. Earlier in the same file, `_this.remoteScript` is populated by downloading content from a remotely controlled URL, which creates a classic remote-code-loading pattern that can be repointed after installation.

js/babTypeInjectionScript.js (Line 52)
this.initRemoteScript(extensionConfig);return function(tab) {    ask.apps.ul.fireInfoEvent(extensionConfig.buildVars.unifiedLoggingUrl, {        message: "browser-action-clicked",        topic: "browser-action"      }, extensionConfig, "BAB")      .catch(Logger.log);    if (_this.handleSubsequentBabClicks(tab, getConnection))      return;    BabClickHandler.getInjectionDetails(tab, extensionConfig.buildVars.newTabURL)      .then(function(injectDetailsArr) {        var remoteScriptInjectionDetails = {          code: _this.remoteScript,          runAt: "document_start"        };        if (injectDetailsArr.length && injectDetailsArr[0].frameId) {          remoteScriptInjectionDetails.frameId = injectDetailsArr[0].frameId;        }        return Promise.all([          Util.injectScriptsSequentially(tab.id, injectDetailsArr, extensionConfig, {            message: "failed-inject-babContentScript lastError",            topic: "browser-action"          }),          new Promise(function(resolve) {            chrome.tabs.executeScript(tab.id, remoteScriptInjectionDetails, resolve);          })        ]);      })

The extension assembles its tracking/install identity by harvesting data from multiple places in priority order: sync storage, domain cookies, localStorage on a remote page, and URL fragments from open tabs. This is an aggressive data-recovery routine for partner IDs, install metadata, and pixel URLs, and it persists even when one source fails.

js/background.js (Line 404)
function getToolbarData(localStorageUrl, cookieDomain, timeout, defaultToolbarData, config) {  var syncStorageAPIFailed = false;  return Dlp.getDataFromSyncStorage()    .catch(function(rejectionObj) {      if (rejectionObj.name !== Dlp.syncErrorValueNotSet) {        syncStorageAPIFailed = true;      }      Logger.log(        "Background: getToolbarData: Fail over to cookies, since fetching DLP data from sync storage failed."      );      return Dlp.getDataFromCookies(cookieDomain);    })    .catch(function(cookiesErr) {      Logger.log("Background: getToolbarData: Failed to get DLP data from COOKIES: " + cookiesErr);      Logger.log(        "Background: getToolbarData: Fail over to LOCAL STORAGE, since fetching DLP data from cookies failed."      );      return Dlp.getDataFromLocalStorage({        url: localStorageUrl,        timeout: timeout,        keys: ["toolbarData"]      }, defaultToolbarData, config);    })    .catch(function(rejectionObj) {        if (!rejectionObj.hasOwnProperty("dataSource")) {          Logger.log("Background: getToolbarData: Failed to get DLP data from LOCAL STORAGE: " +            rejectionObj);          Logger.log(            "Background: getToolbarData: Fail over to URL HASH values, since fetching DLP data from local storage failed."          );          return Dlp.getParamsFromHash(defaultToolbarData);

This extension exposes a code path that can uninstall itself via `chrome.management.uninstallSelf()`. In this codebase, management methods are surfaced through the `webtooltab` messaging bridge to pages hosted on the vendor's domains, so a remote page can drive privileged extension-management actions.

js/webtooltabAPI.js (Line 150)
uninstall: function(customUninstallOptions) {    var uninstall = function() {        return new Promise(function(resolve, reject) {              ask.apps.ul.fireInfoEvent(config.buildVars.unifiedLoggingUrl, {                message: "on-before",                topic: "uninstallAPI"              }, config, null);              new Promise(function(resolve, reject) {                  return window.setTimeout(resolve, 50);                })                .then(function() {                    try {                      var uninstallOptions = {                        showConfirmDialog: !!customUninstallOptions && customUninstallOptions                          .showConfirmDialog || false                      };                      Logger.log("webtooltabAPI: uninstall - uninstall options: " + JSON.stringify(                        uninstallOptions));                      var result = chrome.management.uninstallSelf(uninstallOptions);                      if (result) {                        return result.catch(reject);                      }                    } catch (error) {

The extension enumerates other installed extensions, collects their IDs, versions, enabled state, and specific overlap with monitored permissions. This is surveillance of competing/default-controlling extensions and is later tied to telemetry about whether this extension 'lost' or 'took' default status.

js/watchExtensionsHandler.js (Line 26)
return new Promise(function(resolve) {      chrome.management.getAll(function(extensionInfos) {            var watchExtensions = getEmptyWatchExtensionsObject();            extensionInfos              .filter(function(eInfo) {                return eInfo.type === "extension" &&                  eInfo.id !== chrome.runtime.id &&                  Util.checkOverlap(eInfo.permissions, WatchExtensionsHandler.permissionsToMonitor);              })              .forEach(function(eInfo) {                WatchExtensionsHandler.permissionsToMonitor                  .filter(function(monitorPermission) {                    return ~eInfo.permissions.indexOf(monitorPermission);                  })                  .forEach(function(permission) {                    watchExtensions[permission].stackOfExtensions.push({                      id: eInfo.id,                      version: eInfo.version,                      enabled: eInfo.enabled                    });                  });              });

This code injects a full-page, extremely high z-index iframe over the current site and passes the current tab title and URL into the remote iframe URL. Combined with the remote BAB configuration machinery, this creates a server-controlled overlay channel that can impersonate site UI, run ads, or present phishing prompts on arbitrary pages.

js/babContentScriptAPI.js (Line 101)
} else if (modalWindowType === "iframe") {  if (args.replaceableParams) {    args.replaceableParams.tabtitle = window.document.title;    args.replaceableParams.taburl = window.document.location.href;    _this.contentIframe.src = TextTemplate.parse(args.iframeUrl, args.replaceableParams);  } else {    _this.contentIframe.src = args.iframeUrl;  }}};var contentIframeId = "bab-content-iframe";var contentDivId = "bab-content-div";if (!document || !document.body) {  return Promise.reject(new Error("missing document and/or body blocked content injection"));}var existingContentIframe = document.getElementById(contentIframeId);if (!existingContentIframe) {  _this.modalConfig = modalConfig;  _this.contentDiv = document.createElement("div");  _this.contentDiv.id = contentDivId;  _this.contentDiv.style.cssText = _this.applyModalConfigOnCSS(_this.contentDivCSS);  _this.contentIframe = document.createElement("iframe");  _this.contentIframe.id = contentIframeId;  _this.contentIframe.name = "bab-content";  _this.contentIframe.frameBorder = "0";  _this.contentIframe.scrolling = "no";  _this.contentIframe.style.cssText +=    ";width:99%;\n                        max-width: 100%; height:99%;\n                        overflow: hidden; background-color: transparent; z-index: 9999999999; display: hidden;";

When injected into vendor-controlled pages, this script discloses a stable toolbar ID, partner identifiers, and install date to page JavaScript and also drops detection cookies into the page context. That enables cross-page install tracking and lets the remote site fingerprint whether the extension is present and which affiliate/install it belongs to.

js/extensionDetect.js (Line 102)
function getCommands(configData) {  return {    GET_INFO: function(reply) {      reply({        toolbarId: configData.state.toolbarData.toolbarId,        partnerId: configData.state.toolbarData.partnerId,        partnerSubId: configData.state.toolbarData.partnerSubId,        installDate: configData.state.toolbarData.installDate,        toolbarVersion: configData.buildVars.version,        toolbarBuildDate: configData.buildVars.buildDate,      });    }  };}function setInstalledCookies(toolbarId) {  var hourFromNow = new Date(Date.now() + (1 * 60 * 60 * 1000))    .toUTCString();  document.cookie = "mindsparktb_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/";  document.cookie = "mindsparktbsupport_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/";}

By severity

Critical5
High11
Medium3
Low0

Versions scanned

Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
13.962.19.392256
13.958.19.4030613

Files with findings

12 distinct paths — top paths by unique finding count:

  • js/background.js4
  • js/babTypeInjectionScript.js2
  • js/dlp.js2
  • js/extensionDetect.js2
  • js/watchExtensionsHandler.js2
  • js/babAPI.js1
  • js/babContentScriptAPI.js1
  • js/babRemoteConfigProcessor.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Code Injection
critical
js/babAPI.js (line 69)The `inject-script` background feature accepts arbitrary JavaScript code (`babMessage.args.code`) and a URL regex from an external message, then executes that code inside matching iframes via `chrome.tabs.executeScrip…
13.958.19.40306
2Privilege Escalation
critical
ntp1.html (line 25)The hijacked new-tab page renders a full-screen iframe that is granted `geolocation`, `microphone`, `camera`, `midi`, and `encrypted-media` permissions via the `allow` attribute. The iframe `src` is set dynamically to…
13.958.19.40306
3Remote Code Loading
critical
js/babTypeInjectionScript.js (line 52)This code executes arbitrary JavaScript stored in `_this.remoteScript` directly into the active tab at `document_start`. Earlier in the same file, `_this.remoteScript` is populated by downloading content from a remote…
13.962.19.39225
4Remote Code Loading
critical
js/babTypeInjectionScript.js (line 4)The extension fetches a raw JavaScript string from a remote URL (`babRemoteScriptUrl`) and then directly injects it into active tabs via `chrome.tabs.executeScript` with `runAt: "document_start"`. This is a classic re…
13.958.19.40306
5Remote Code Loading
critical
js/babRemoteConfigProcessor.js (line 14)The background page loads a remotely-configured `proxyUrl` in a hidden iframe and establishes a bidirectional message channel between this remote iframe and the extension's content scripts. The proxy URL is pulled fro…
13.958.19.40306
6Data Exfiltration
high
js/offerService.js (line 277)The OfferService periodically contacts a remote server configured via `offerServiceConfigUrl`, sending a comprehensive device/user fingerprint including userAgent, OS, platform, browser version, language, locale, coun…
13.958.19.40306
7Phishing
high
js/babContentScriptAPI.js (line 101)This code injects a full-page, extremely high z-index iframe over the current site and passes the current tab title and URL into the remote iframe URL. Combined with the remote BAB configuration machinery, this create…
13.962.19.39225
8Privilege Escalation
high
js/webtooltabAPI.js (line 150)This extension exposes a code path that can uninstall itself via `chrome.management.uninstallSelf()`. In this codebase, management methods are surfaced through the `webtooltab` messaging bridge to pages hosted on the …
13.962.19.39225
9Tracking
high
js/extensionDetect.js (line 108)When injected into any mysocialshortcut.com page, this content script sets tracking cookies (`mindsparktb_<id>` and `mindsparktbsupport_<id>`) in the context of that domain. These cookies are readable by the domain's …
13.958.19.40306
10Tracking
high
js/background.js (line 426)Every 6 hours the extension fires a `ToolbarActive` beacon to `https://live.tb.ask.com/tr.gif` containing the Chrome extension ID (`cwsid`), toolbar ID, partner ID, partner sub-ID, version, build date, and co-ID. This…
13.958.19.40306
11Unauthorized Data Collection
high
js/background.js (line 404)The extension assembles its tracking/install identity by harvesting data from multiple places in priority order: sync storage, domain cookies, localStorage on a remote page, and URL fragments from open tabs. This is a…
13.962.19.39225
12Unauthorized Data Collection
high
js/watchExtensionsHandler.js (line 26)The extension enumerates other installed extensions, collects their IDs, versions, enabled state, and specific overlap with monitored permissions. This is surveillance of competing/default-controlling extensions and i…
13.962.19.39225
13Unauthorized Data Collection
high
js/localStorageContentScript.js (line 9)This content script is injected into `https://download.mysocialshortcut.com/blank.jhtml` and, on command, reads the entire `window.localStorage` of that origin (or specific keys requested by the background) and transm…
13.958.19.40306
14Unauthorized Data Collection
high
js/dlp.js (line 229)The extension calls `chrome.cookies.getAll({ domain: '.mysocialshortcut.com' })` to read all cookies set on that domain, extracting user tracking identifiers (toolbarId, partnerId, coId, countryCode, partnerSubId, ins…
13.958.19.40306
15Unauthorized Data Collection
high
js/watchExtensionsHandler.js (line 4)Using the `management` permission, the extension enumerates every installed browser extension (IDs, versions, enabled state) at startup and then continuously monitors all install, uninstall, enable, and disable events…
13.958.19.40306
16Unauthorized Data Collection
high
js/dlp.js (line 43)As a fallback DLP data source, the extension queries ALL open tabs (`chrome.tabs.query({})`) and iterates every iframe in every tab via `chrome.webNavigation.getAllFrames` to scan URL hashes for tracking parameters. T…
13.958.19.40306
17Code Injection
medium
js/background.js (line 481)The background script uses `chrome.tabs.onUpdated` to monitor all tab navigations and dynamically injects content scripts into any page matching `*.mysocialshortcut.com` at `document_start` (before the page's own scri…
13.958.19.40306
18Tracking
medium
js/extensionDetect.js (line 102)When injected into vendor-controlled pages, this script discloses a stable toolbar ID, partner identifiers, and install date to page JavaScript and also drops detection cookies into the page context. That enables cros…
13.962.19.39225
19Tracking
medium
js/background.js (line 95)On installation, the extension fires a tracking pixel to an affiliate network URL (`pixelUrl` extracted from cookies/localStorage) and fires an `InstallerFinished` telemetry event to `anx.tb.ask.com`. It then closes t…
13.958.19.40306
URLs
25
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

download.mysocialshortcut.com/blank.jhtmlhttps://download.mysocialshortcut.com/blank.jhtml
live.tb.ask.com/tr.gifhttps://live.tb.ask.com/tr.gif
anx.tb.ask.com/anx.gifhttps://anx.tb.ask.com/anx.gif
download.mysocialshortcut.com/anemone.jhtmlhttps://download.mysocialshortcut.com/anemone.jhtml
{{hostname}}/install_pixels.jhtmlhttps://{{hostname}}/install_pixels.jhtml?partner={{partnerId}}&sub_id={{partnerSubId}}&coId={{coId}}&tbGuid={{toolbarId}}&s2={{s2}}&s3={{s3}}&s4={{s4}}&s5={{s5}}
{{hostname}}/conversion.htmlhttps://{{hostname}}/conversion.html?ref={{ref}}&cobrand={{cobrand}}&campaign={{campaign}}&track={{dlput}}&si={{partnerSubId}}&s2={{s2}}&s3={{s3}}&s4={{s4}}&s5={{s5}}&coId={{coId}}&country={{countryCode}}&otOptIn={{ot}}&pDomain={{pd}}&vendor={{vd}}&pGroup={{pg}}&nfc={{nfc}}&guid={{toolbarId}}&ver={{ver}}&sig={{sgn}}
ext.ask.com/%7B%7Bsoep%7D%7Dhttps://ext.ask.com/{{soep}}?productName={{pname}}&installDate={{installDate}}&partnerId={{partnerId}}&si={{partnerSubId}}&tbGuid={{toolbarId}}&coId={{coId}}&isAudioEnabled={{ae}}&isRebuttalEnabled={{re}}
hp.myway.com/mysocialshortcut/ttab02chr/index.htmlhttps://hp.myway.com/mysocialshortcut/ttab02chr/index.html?p2=${partnerID}&n=${installDateHex}&ptb=${toolbarID}&si=${partnerSubID}&cwsid=${cwsid}
mysocialshortcut.dl.myway.com/uninstall.jhtmlhttps://mysocialshortcut.dl.myway.com/uninstall.jhtml?c=
download.mysocialshortcut.com/images/download/static/native/notifications/%7B%7BcobrandID%7D%7D/%7B%7BtrackID%7D%7D/logger-config.jsonhttps://download.mysocialshortcut.com/images/download/static/native/notifications/{{cobrandID}}/{{trackID}}/logger-config.json
Showing 1 to 10 of 30 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Version
Size
Is Malicious
Findings
Permhash
13.962.19.39225
Latest
0.10 MB
Malicious
6
13.958.19.40306
0.10 MB
Malicious
13
13.958.19.9343
0.10 MB
Malicious
—
13.986.19.62923
0.38 MB
Malicious
—
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.