Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Privacy Defender for Gmail

CRITICAL RISKRemoved from Chrome Web Store

Privacy Defender for Gmail

ID: jnpffedocibnnflpkjidanccehbepobm

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

1.0.3

Size

0.91 MB

Rating

0.0/5

Reviews

Users

100,000

Type

Extension

Updated

Aug 11, 2023

Publisher Contextual Analysis

Trusted

Author: Privacy DefenderView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

100,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Stop trackers and ads on Gmail.

Elevate your Gmail experience with Privacy Defender - the ultimate shield against intrusive email trackers and unwanted Google ads. Safeguard your privacy by blocking concealed trackers from monitoring when and where you open your emails. Plus, enjoy a cleaner inbox by keeping distracting ads at bay. With Gmail Guard, embrace a safer, smoother, and ad-free emailing journey. Install today and reclaim your email privacy! 💌

User Growth

Showing data from Aug 10, 2023 to Jul 03, 2024

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium0

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2 Code review	6

Extension Version	Code Review Findings
1.0.2	6

Files with findings

3 distinct paths — top paths by unique finding count:

sw.js3
c.js2
page.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	c.js (line 25)	The content script pulls server-controlled `command` and `element` values out of chrome.storage.local and forwards them via data-* attributes to page.js, which executes in the page's MAIN world. Because the values ori…	1.0.2
2	Remote Code Loading	critical	sw.js (line 36)	A daily alarm fetches arbitrary JSON from privacy-defender.info and stores the entire response into chrome.storage.local without validation. The content script later reads these fields (command, element) and uses them…	1.0.2
3	Remote Code Loading	critical	page.js (line 1)	This web-accessible page-world script creates an arbitrary element type (e.g. 'script', 'iframe') with an arbitrary src controlled by the remote server and appends it to the document. This is textbook remote code load…	1.0.2
4	Tracking	high	sw.js (line 5)	On install, the service worker contacts an attacker-controlled C2 endpoint to obtain a unique per-user identifier (wkqfp) and scheduling parameters. The identifier is persisted and echoed back on every outbound call, …	1.0.2
5	Tracking	high	sw.js (line 23)	A persistent 'live' alarm beacons the per-user wkqfp identifier back to the remote server, and a daily 'update' alarm pulls fresh command configuration. Together with the install-time handshake and uninstall URL, this…	1.0.2
6	Unauthorized Data Collection	high	c.js (line 41)	When the user composes/replies to a Gmail message, the extension silently appends an HTML signature containing a tracking link to privacy-defender.info into the outgoing email body. Mail recipients who click will hit …	1.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

206

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


privacy-defender.info	/store.php	https://privacy-defender.info/store.php?it=CFGMAIL
googleads	-	https://googleads
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
mail.google.com	/*	https://mail.google.com/*
www.google.com	/*	https://www.google.com/*
www.google.ad	/*	https://www.google.ad/*
www.google.ae	/*	https://www.google.ae/*
www.google.com.af	/*	https://www.google.com.af/*
www.google.com.ag	/*	https://www.google.com.ag/*
www.google.com.ai	/*	https://www.google.com.ai/*

Showing 1 to 10 of 210 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


188.72.219.36	IPv4	-
117.254.84.212	IPv4	-
142.91.159.244	IPv4	-
162.252.214.4	IPv4	-
167.99.31.227	IPv4	-
203.195.121.11	IPv4	-
203.195.121.1	IPv4	-
203.195.121.46	IPv4	-
23.109.248.135	IPv4	-
23.109.248.229	IPv4	-
23.109.82.173	IPv4	-
23.109.87.101	IPv4	-
23.109.87.42	IPv4	-
37.1.209.213	IPv4	-
51.77.227.100	IPv4	-
51.77.227.101	IPv4	-
51.77.227.102	IPv4	-
51.77.227.103	IPv4	-
51.77.227.96	IPv4	-
51.77.227.97	IPv4	-
51.77.227.98	IPv4	-
51.77.227.99	IPv4	-
51.89.187.136	IPv4	-
51.89.187.137	IPv4	-
51.89.187.138	IPv4	-
51.89.187.139	IPv4	-
51.89.187.140	IPv4	-
51.89.187.141	IPv4	-
51.89.187.142	IPv4	-
51.89.187.143	IPv4	-
167.206.10.148	IPv4	-
110.93.143.144	IPv4	-
149.13.65.144	IPv4	-
180.76.2.18	IPv4	-
195.10.245.55	IPv4	-
212.227.100.108	IPv4	-
212.95.32.75	IPv4	-
62.160.52.73	IPv4	-
66.228.52.30	IPv4	-
67.228.151.70	IPv4	-
72.172.88.25	IPv4	-
74.55.82.102	IPv4	-
79.125.117.123	IPv4	-
188.42.84.162	IPv4	-
142.91.159.107	IPv4	-
143.244.184.39	IPv4	-
146.59.223.83	IPv4	-
176.31.68.242	IPv4	-
185.147.34.126	IPv4	-
188.42.84.199	IPv4	-
23.109.150.101	IPv4	-
23.109.82.104	IPv4	-
23.109.82.74	IPv4	-
23.109.87.15	IPv4	-
23.109.87.71	IPv4	-
5.45.79.15	IPv4	-
51.178.195.171	IPv4	-
51.195.115.102	IPv4	-
51.89.115.13	IPv4	-
185.165.169.108	IPv4	-
185.145.131.204	IPv4	-
173.212.233.209	IPv4	-
158.69.120.31	IPv4	-
1.4.2.1	IPv4	-
111.90.150.149	IPv4	-
111.90.159.132	IPv4	-
35.232.188.118	IPv4	-
35.224.227.218	IPv4	-
34.70.28.179	IPv4	-
139.99.120.222	IPv4	-
193.197.158.209	IPv4	-
208.88.226.75	IPv4	-
216.18.184.18	IPv4	-
160.16.86.134	IPv4	-
58.205.218.4	IPv4	-
199.19.203.46	IPv4	-
81.176.238.128	IPv4	-
77.91.202.130	IPv4	-

Showing 1 to 78 of 80 rows

Rows per page:

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

This extension is a must-have for any Gmail user. It effectively blocks trackers and ads, ensuring a safer and cleaner email experience.

Gektor Daniel·4 Nov 2023

This extension has made my Gmail experience so much better! It effortlessly blocks trackers and annoying ads, giving me a cleaner inbox and protecting my privacy. Highly recommended!

Jaylee Byers·4 Nov 2023

Działa świetnie na moim koncie Gmail. Bardzo polecam.

Amayah Wiggins·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Privacy Defender for Gmail

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating