Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Private Web

CRITICAL RISKRemoved from Chrome Web Store

Private Web

ID: hljpkckjkdmaaajkajmdlmhbginbgibg

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.0.1

Size

0.08 MB

Rating

0.0/5

Reviews

Users

50,000

Type

Extension

Updated

May 17, 2024

Publisher Contextual Analysis

Author: https://privatewebhub.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

50,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Activates anonymous view to default search for searching the internet and viewing without tracking.

This extension allows users to visit the websites from their search results anonymously as if they are using a VPN. While using this feature, the user’s identity and data are completely shielded. Privacy Policy: https://www.privatewebhub.com/privacy Terms and Conditions: https://www.privatewebhub.com/terms

User Growth

Showing data from Sep 16, 2023 to Sep 14, 2024

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium3

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.0 Code review	6

Extension Version	Code Review Findings
3.0.0	6

Files with findings

3 distinct paths — top paths by unique finding count:

bg/background.js3
manifest.json2
popup/popup.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	high	popup/popup.js (line 100)	Any URL the user types into the popup is routed through a server-side 'proxy' endpoint on searchprivateweb.com (config.proxy = `${url.origin}${url.pathname}/?action=proxy&proxyurl=1&s=...&q=`). This causes the destina…	3.0.0
2	Privilege Escalation	high	bg/background.js (line 127)	On install the extension reads a server-controlled cookie named 'clst' from searchprivateweb.com; if present it silently closes all popup-type browser tabs. This is a remote kill-switch / anti-detection mechanism: the…	3.0.0
3	Tracking	high	manifest.json (line 7)	The extension hijacks the browser's default search engine, redirecting all searches (and even typed suggestions via suggest_url) to searchprivateweb.com with tracking parameters (s=dfpr, vert=private, extversion). Eve…	3.0.0
4	Other	medium	manifest.json (line 47)	A full 136KB jQuery 3.5.1 library is injected into every frame of every yahoo.com page, yet no other script consumes it and the content_script bundle contains no domain-specific logic. Bundling an unused library into …	3.0.0
5	Privilege Escalation	medium	bg/background.js (line 43)	The background service worker exposes a runtime.onMessage handler that calls chrome.management.uninstallSelf({showConfirmDialog:false}) — silently uninstalling the extension with no user confirmation dialog. Any page …	3.0.0
6	Tracking	medium	bg/background.js (line 104)	The extension writes cookies ('use_ac', 'se') with SameSite=None on the searchprivateweb.com apex domain, synchronizing extension-side state with the backend server. Combined with the install/uninstall URLs (containin…	3.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


${config.domain}`,	-	https://${config.domain}`,
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.searchprivateweb.com	/favicon.ico	https://www.searchprivateweb.com/favicon.ico
www.searchprivateweb.com	/search/	https://www.searchprivateweb.com/search/?category=web&extversion=3.0.0&s=dfpr&vert=private&q={searchTerms}
sug.searchprivateweb.com	/v1/sug/	https://sug.searchprivateweb.com/v1/sug/?yid=dfpr&ssv=2&vert=private&q={searchTerms}
www.searchprivateweb.com	/wim/gotohub	https://www.searchprivateweb.com/wim/gotohub?s=dfpr
fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Inter:wght@300;400;700;900&display=swap
www.${config.domain}	/wim/help	https://www.${config.domain}/wim/help?s=${config.yid}`

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Private Web

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating