Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Productive Search for Chrome™

CRITICAL RISKRemoved from Chrome Web Store

Productive Search for Chrome™

ID: iiegilogjnagependdonbfcmfmmaamon

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.4.1.10247

Size

0.57 MB

Rating

3.8/5

Reviews

Users

100,000

Type

Extension

Updated

Jun 22, 2024

Publisher Contextual Analysis

Trusted

Author: https://securybrowse.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

530,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Switches the default search to enhance productivity.

The extension changes your default search engine to our search for enhanced productivity. Transform your search experience into a productivity powerhouse with Productive Search for Chrome! Our extension empowers you to enhance productivity by activating 'Zen mode,' which intelligently blocks searches that leads to social media and other non-productive websites. Elevate your search game and reclaim your productivity with Productive Search for Chrome!. For any inquiries, don't hesitate to contact us at [email protected]

User Growth

Showing data from Sep 16, 2023 to Sep 14, 2024

Versions

No change in user count

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 16 ratings

Average Rating

Current: 3.75 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High7

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.4.1.9967 Code review	10

Extension Version	Code Review Findings
1.4.1.9967	10

Files with findings

3 distinct paths — top paths by unique finding count:

background.js8
manifest.json1
sbCrash.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.js (line 4509)	The background calls chrome.scripting.executeScript to drop this harness into any tab, which injects a hidden iframe whose src is a remote URL supplied by the extension backend and then exposes a postMessage RPC (msg …	1.4.1.9967
2	Remote Code Loading	critical	background.js (line 6012)	Every server response is inspected for an 'lst' field (ji → Cr); each item in that list is dispatched to one of 16 registered handler classes (_r), one of which is the iframe-injection handler (vr/sn) and others invok…	1.4.1.9967
3	Credential Theft	high	background.js (line 2902)	Thin promise wrappers over chrome.cookies.get/getAll/set/getAllCookieStores are wired into the pipeline (W() iterates cookies and serializes domain+time pairs to the server). With the 'cookies' permission plus <all_ur…	1.4.1.9967
4	Data Exfiltration	high	sbCrash.js (line 47)	This content script runs on every URL the user visits and every 30 seconds pings the background. If the service worker is gone (extension disabled/uninstalled or any error), it fires a pixel-image beacon (new Image().…	1.4.1.9967
5	Data Exfiltration	high	background.js (line 8634)	Ti() is the generic telemetry sink that POSTs (via the XOR-obfuscated Ci wrapper) every user action — popup opens, tab updates, idle state, runtime startup, every search keyword with tabId and requestDetails, and ever…	1.4.1.9967
6	Network Interception	high	background.js (line 7614)	The extension hooks essentially every webRequest lifecycle event across <all_urls> for every resource type (main_frame, sub_frame, stylesheet, script, image, xmlhttprequest, etc.) including responseHeaders and request…	1.4.1.9967
7	Obfuscation	high	background.js (line 247)	All backend POSTs are sent with content-type application/x-binary after XOR-ing the JSON payload with a single-byte key (d=255) and base64-encoding it. Responses are symmetrically decoded. This is not encryption — it …	1.4.1.9967
8	Tracking	high	background.js (line 7461)	The extension registers onSendHeaders against <all_urls> with requestHeaders/extraHeaders access and harvests the Referer header of every request, indexing by both requestId and tabId. Combined with the main_frame onC…	1.4.1.9967
9	Unauthorized Data Collection	high	manifest.json (line 13)	The extension forcibly overrides the user's default search engine to securybrowse.com and ships every address-bar keystroke to v2.securybrowse.com via the suggest_url. Combined with <all_urls> host permissions, cookie…	1.4.1.9967
10	Tracking	medium	background.js (line 9164)	On install the extension sets chrome.runtime.setUninstallURL to securybrowse.com/api/back/uninstall?eid=<extension_id>, so when a user removes the extension their browser is forced to open the vendor's URL. This is tr…	1.4.1.9967

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


securybrowse.com	-	https://securybrowse.com
v2.securybrowse.com	-	https://v2.securybrowse.com
ext.securybrowseit.com	-	https://ext.securybrowseit.com
unknow.com	-	http://unknow.com
v2.securybrowse.com	/src/background.js.efbe36e873bf33ff4d8f.map	https://v2.securybrowse.com/src/background.js.efbe36e873bf33ff4d8f.map
securybrowse.com	/feedback.html	https://securybrowse.com/feedback.html
v2.securybrowse.com	/src/popup.js.efbe36e873bf33ff4d8f.map	https://v2.securybrowse.com/src/popup.js.efbe36e873bf33ff4d8f.map
v2.securybrowse.com	/src/sbCrash.js.efbe36e873bf33ff4d8f.map	https://v2.securybrowse.com/src/sbCrash.js.efbe36e873bf33ff4d8f.map
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

We invite you to join us in our partnership to expand your revenue and grow your chrome extension. Let's explore how we can help you. Learn more at: https://extensionbuysell.com Looking forward to working with you!

Madison Francis·19 Sept 2024

This is nothing but malware. Don't use it.

Bonnie Obadal·22 Jul 2021

Run, quickly....or just close the browser.

Devon Walton (Home account)

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Productive Search for Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating