Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Referer Manager

CRITICAL RISKRemoved from Chrome Web Store

Referer Manager

ID: fpfmkkljdiofokoikgglafnfmmffmmhc

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.5.3

Size

0.26 MB

Rating

4.7/5

Reviews

Users

934,095

Type

Extension

Updated

Sep 16, 2022

Publisher Contextual Analysis

Trusted

Author: Kornelia OlofssonView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

934,095

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Control your referer headers. Apply flexible rules to block, allow, or change HTTP referer.

Referer manager changes HTTP referer with flexible configuration. You can spoof a referrer for some reason. It could be helpful for developers and marketers. Features: ✰ Block, allow, change referrers ✰ Applies to both referrer HTTP headers and javascript document.referrer value ✰ Apply rules for a specific domain, URL, or even using regular expressions ✰ You can apply a rule to requests originated from a specific domain to requests to a specific domain, or only to 3rd party requests. Please note, that by default JS referrer spoofing is disabled. It could break functionality on some sites.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+179.11%(+599,421 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 9 ratings

Average Rating

Current: 4.89 / 5.0-0.11

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium3

Low0

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.2 Code review	2
1.5.1 Code review	5

Extension Version	Code Review Findings
1.5.2	2
1.5.1	5

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js6
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	high	js/background.js (line 409)	The privileged background page dynamically loads remote JavaScript from `https://www.google-analytics.com/analytics.js` and immediately sends analytics events. In an extension context this is a strong risk signal beca…	1.5.2
2	Remote Code Loading	high	js/background.js (line 2)	An immediately-invoked function expression dynamically creates a <script> element and injects analytics.js from https://www.google-analytics.com/analytics.js into the background page at runtime. This constitutes remot…	1.5.1
3	Unauthorized Data Collection	high	js/background.js (line 2)	The background script silently initializes Google Analytics with tracking ID UA-190561470-1 and fires a pageview hit for '/background' on every browser startup. The call ga("set","checkProtocolTask",null) deliberately…	1.5.1
4	Unauthorized Data Collection	high	manifest.json (line 1)	The manifest explicitly relaxes the default Content Security Policy to permit script execution from https://www.google-analytics.com. A legitimate referer-management extension has no functional requirement to load ext…	1.5.1
5	Network Interception	medium	js/background.js (line 211)	The background script inspects every outgoing request, reads the existing Referer header, and can overwrite or remove it before the request is sent. Combined with the extension's `<all_urls>` webRequestBlocking scope,…	1.5.2
6	Other	medium	js/background.js (line 1)	A generic XMLHttpRequest GET helper is defined on the rc object with a full response callback. This utility is not called anywhere in the visible source but is present as a ready-made capability on the extension's cen…	1.5.1
7	Tracking	medium	js/background.js (line 1)	The rc.update() function records the exact epoch timestamp of when the extension was first installed (Date.now()) and persists it to chrome.storage.local under the key 'RefererControlInstall'. This install timestamp i…	1.5.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
*.example.com	-	http://*.example.com
foo.com	-	https://foo.com
www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
www.	-	http://www.
jquery.com	-	https://jquery.com/
sizzlejs.com	-	https://sizzlejs.com/
jquery.org	/license	https://jquery.org/license

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

4.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

There is no option to opt out of Google Analytics in the options as stated in the privacy policy.

Alexa Margaret·29 Dec 2022

Overall good app but there are times where when you set a site to "Allow" in the filter and it still does not work. For example on Instagram.com I cannot get some images to load and I set it to "Allow" and still the site does not work unless I turn the entire addon off. I tried contacting the developer using the email here but it says The email account that you tried to reach does not exist.

John Quers·4 Feb 2022

One of the most useful extensions.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Referer Manager

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating