Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Search and Start page — Yandex

CRITICAL RISKRemoved from Chrome Web Store

Search and Start page — Yandex

ID: gopekdefbcehhdiejdiaijhojgbepgec

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

🇺🇦Ukrainian

Extension Info & Metadata

Status

Removed

Version

9.0.8

Size

0.02 MB

Rating

2.6/5

Reviews

Users

400,000

Type

Extension

Updated

Aug 7, 2025

Publisher Contextual Analysis

Author: https://www.yandex.com.tr/View Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Type your search queries into the address bar and get answers from Yandex

Яндекс станет вашей стартовой страницей и основным поиском. Запустив браузер, вы сможете сразу смотреть погоду, пробки, читать новости или включать любимые телепередачи. А если понадобится что-то найти — быстро задать вопрос Яндексу прямо в адресной строке. Он будет угадывать популярные сайты по первым буквам и на многие вопросы отвечать сразу. Устанавливая программу, вы принимаете условия Лицензионного соглашения http://legal.yandex.ru/desktop_software_agreement/.

User Growth

Showing data from Nov 26, 2023 to Dec 02, 2024

Versions

+33.33%(+100,000 users)

Compared to 11 months ago

2 versions released in this period

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium5

Low0

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
9.0.8 Code review	5
9.0.2 Code review	5

Extension Version	Code Review Findings
9.0.8	5
9.0.2	5

Files with findings

1 distinct path — top paths by unique finding count:

service_worker.js10

S.No.	Category	Severity	File	Summary	Found in Version
1	Tracking	high	service_worker.js (line 1)	The extension reads existing 'ys' session cookies on 8 distinct Yandex/ya.ru domains and injects three new fields: the user's unique tracking UUID (ui), the Chrome extension ID (gchid), and the extension version. This…	9.0.8
2	Tracking	high	service_worker.js (line 1)	The extension sets a tracking cookie named 'ext-<runtime_id>' on 8 New Tab Page URLs (2 URL patterns × 4 TLDs: ru, ua, by, kz), encoding install date, update date, current timestamp, and a campaign/referral CLID. Sett…	9.0.8
3	Tracking	high	service_worker.js (line 449)	This code builds a telemetry request to `https://soft.export.yandex.ru/status.xml` that includes a persistent UI identifier, campaign/banner attribution, browser/OS details, and the extension ID. That is a substantial…	9.0.2
4	Tracking	high	service_worker.js (line 385)	This routine writes a JSON blob into cookies on multiple Yandex domains, containing install/update timestamps and marketing attribution data, then refreshes it every hour. Cross-domain cookie propagation from an exten…	9.0.2
5	Unauthorized Data Collection	high	service_worker.js (line 1)	Every day (via chrome.alarms), the extension beacons a detailed user profile to Yandex analytics endpoints including: unique user UUID, browser fingerprint, days-since-install, campaign attribution IDs, banner source …	9.0.8
6	Tracking	medium	service_worker.js (line 330)	On install, the extension preconfigures an uninstall URL carrying identifiers and install metadata, so when the user removes the extension the browser is directed to a vendor page with tracking parameters. Using `setU…	9.0.2
7	Tracking	medium	service_worker.js (line 246)	The background worker enumerates all tabs, locates the extension's Chrome Web Store page, extracts a `banerid` parameter, and persists it in local storage. That is campaign attribution logic rather than user-facing fu…	9.0.2
8	Tracking	medium	service_worker.js (line 629)	This code reads and rewrites the `ys` cookie across many Yandex domains, injecting the extension version under a dedicated key and repeating the update on a timer. While not code injection, it is a persistent cross-si…	9.0.2
9	Unauthorized Data Collection	medium	service_worker.js (line 1)	On install, the extension pre-registers a detailed uninstall beacon URL at yandex.ru/soft/extensions/goodbye that transmits the user's unique UUID, OS platform, install date, Chrome runtime ID, banner source, version,…	9.0.8
10	Unauthorized Data Collection	medium	service_worker.js (line 1)	At startup and on install, the extension calls `chrome.tabs.query({})` with no URL filter, enumerating all open tabs in the browser. It scans for Chrome Web Store tabs containing the extension's ID to extract URL para…	9.0.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


yandex.ru	/q/search	https://yandex.ru/q/search?text=__QUERY__&from=searchext
yandex.ru	/archive/search	https://yandex.ru/archive/search?text=__QUERY__&from=homesearchext
yandex.ua	/q/search	https://yandex.ua/q/search?text=__QUERY__&from=searchext
yandex.com	/archive/search	https://yandex.com/archive/search?text=__QUERY__&from=homesearchext
yandex.com	/video/search	https://yandex.com/video/search?text=__QUERY__&from=searchext
yandex.ru	-	https://yandex.ru
chromewebstore.google.com	/detail/	https://chromewebstore.google.com/detail/
chrome-elements.yandex.addons	-	http://chrome-elements.yandex.addons/
yandex.{tld}	/chrome/newtab/	https://yandex.{tld}/chrome/newtab/
www.yandex.{tld}	/chrome/newtab/	https://www.yandex.{tld}/chrome/newtab/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Именно. чтобы Яндекс стал стартовой.

ВЕ

Владимир Елецкий·4 Aug 2025

Нравится поиск, панель с ярлыками нужных сайтов удобная, погода, ссылка на почту на новой вкладке. Даже реклама под строкой поиска сделана хорошо. Не мешает и выглядит интересно. Но мне нужно, чтобы при открытии браузера, открывались прежние вкладки. А ваше расширение почему-то решило, что оно лучше знает, что мне надо при запуске браузера и заблокировало эту настройку. Кроме того, хром определяет, что одно из расширений изменило настройки и сбрасывает их при каждом запуске. В итоге, расширение выглядит как хорошая идея, которая разбилась об реализацию. Придётся удалить.

АХ

Андрей Харченко·28 Jul 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Search and Start page — Yandex

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating