Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Nano Adblocker

CRITICAL RISKRemoved from Chrome Web Store

Nano Adblocker

ID: gabbbocakeomblphkmmnoamkioajlkfo

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0.0.154

Size

3.04 MB

Rating

4.8/5

Reviews

255

Users

182,311

Type

Extension

Updated

Oct 15, 2020

Publisher Contextual Analysis

Author: Nano DevsView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

182,311

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

An adblocker

Features highlight - Block ads and popups, works out of the box - Create elements hiding rules through extension icon - Report an issue or bug with a few clicks - Powerful filters editor and linter for advanced users and filters maintainers Best experience with Nano Defender. Source code: https://github.com/nenodevs/NanoCore2

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium7

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.153 Code review	12

Extension Version	Code Review Findings
1.0.0.153	12

Files with findings

5 distinct paths — top paths by unique finding count:

js/contentscript.js5
assets/resources/scriptlets.js4
web_accessible_resources/hd-main.js1
web_accessible_resources/nobab.js1
web_accessible_resources/window.open-defuser.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/contentscript.js (line 467)	This function dynamically creates a script element and injects arbitrary text content into the live DOM of every visited web page. The content is not validated here — it is driven entirely by whatever the background p…	1.0.0.153
2	Remote Code Loading	critical	js/contentscript.js (line 1700)	Scriptlet payloads are received from the background page over the extension messaging channel and immediately injected into the web page's DOM via `vAPI.injectScriptlet`. Because the scriptlet content originates from …	1.0.0.153
3	Network Interception	high	assets/resources/scriptlets.js (line 1318)	This script replaces the page's native fetch implementation and rewrites requests hitting an `/access_token` endpoint on Twitch. Even if intended to bypass ad-delivery logic, modifying authentication/token-related net…	1.0.0.153
4	Unauthorized Data Collection	high	js/contentscript.js (line 1729)	On every page load the content script transmits the full URL of the current page (`window.location.href`) along with frame context flags to the background process. While this is architecturally required for filter loo…	1.0.0.153
5	Code Injection	medium	web_accessible_resources/nobab.js (line 65)	This resource proxies both `window.eval` and `window.setTimeout` globally on any page that loads it. The eval proxy inspects every string passed to eval and can silently swallow calls that match its heuristics. Becaus…	1.0.0.153
6	Network Interception	medium	assets/resources/scriptlets.js (line 232)	The `addEventListener-defuser` scriptlet replaces the global `EventTarget.prototype.addEventListener` with a Proxy on every page where it is injected. This intercepts all event listener registrations across the entire…	1.0.0.153
7	Network Interception	medium	assets/resources/scriptlets.js (line 341)	The `json-prune` scriptlet replaces the global `JSON.parse` with a Proxy that intercepts and can mutate every JSON response parsed by the page. While nominally used to strip ad-tracking fields, the same hook can inspe…	1.0.0.153
8	Network Interception	medium	web_accessible_resources/window.open-defuser.js (line 67)	This code hooks `window.open` with a Proxy and silently suppresses or replaces popup windows with hidden decoy frames/objects. That is a strong browser-behavior interception capability; in a malicious extension, the s…	1.0.0.153
9	Phishing	medium	assets/resources/scriptlets.js (line 1849)	This scriptlet implements a generic redirect primitive: when activated with a parameter name, it reads a URL from the current page's query string and forces navigation to that destination. Although it may be used to b…	1.0.0.153
10	Tracking	medium	js/contentscript.js (line 1601)	A `mousedown` listener captures every click's pixel coordinates and the `href` of any link under the cursor, then sends it to the background page. This gives the background page a stream of clicked link URLs for every…	1.0.0.153
11	Unauthorized Data Collection	medium	js/contentscript.js (line 218)	The CSP violation listener captures `document.location.href` and the full violation event payloads (including blocked resource URLs and original policies) and streams them to the background page on every CSP event. Co…	1.0.0.153
12	Obfuscation	low	web_accessible_resources/hd-main.js (line 22)	This scriptlet creates an object with ~130 short obfuscated property names (all mapped to no-op functions) and assigns it to `window.L` and `window.J`, overwriting any existing globals with those names. The minified t…	1.0.0.153

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

669

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/nenodevs/NanoCore2/blob/master/notes/advanced_settings.md	https://github.com/nenodevs/NanoCore2/blob/master/notes/advanced_settings.md#advanced-settings
github.com	/gorhill/uBlock/wiki/Strict-blocking	https://github.com/gorhill/uBlock/wiki/Strict-blocking
fsf.org	-	http://fsf.org/
www.gnu.org	/licenses/	http://www.gnu.org/licenses/
www.gnu.org	/philosophy/why-not-lgpl.html	http://www.gnu.org/philosophy/why-not-lgpl.html
github.com	/nenodevs/NanoCore2/releases	https://github.com/nenodevs/NanoCore2/releases
github.com	/NanoAdblocker/NanoDoc	https://github.com/NanoAdblocker/NanoDoc
github.com	/NanoAdblocker/NanoFilters/issues	https://github.com/NanoAdblocker/NanoFilters/issues
github.com	/NanoAdblocker/NanoCore/issues	https://github.com/NanoAdblocker/NanoCore/issues
github.com	/nenodevs/NanoCore2	https://github.com/nenodevs/NanoCore2

Showing 1 to 10 of 670 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.154	IPv4	-
0.0.0.0	IPv4	-
127.0.0.1	IPv4	-
255.255.255.255	IPv4	-

1.1 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Autrefois considéré comme une alternative à Ublock Origin, l'application vient d'être vendue à des développeurs turcs dans le but d'utiliser les données des utilisateurs à des fins marketing. Si le développeur n'avait pas lancé l'alerte, on aurait mis plus de temps à le d��couvrir ( https://www.ghacks.net/2020/10/16/time-to-remove-nano-adblocker-and-defender-from-your-browsers-except-firefox/ ). A fuir donc. Personnellement, je retourne chez Ublock Origin.

Rave'L S·16 Oct 2020

身元が不明なトルコの開発チームが買収後、特定のブラウザのデータを送信する挙動が追加されたことがuBlock Originの開発者により解読されました... 何があるのかわからないので使わないほうが吉かと

a a·16 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Nano Adblocker

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews