Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Settings for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Settings for Chrome

ID: ojpnlpccfabehnhgomligckdldhcebnn

Could be malicious

Supported Languages

🇪🇹Amharic

🇸🇦Arabic

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇱Hebrew

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇮🇳Kannada

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇳🇴Norwegian

🇮🇷Persian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇰🇪Swahili

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.2.3

Size

0.08 MB

Rating

3.8/5

Reviews

Users

600,000

Type

Extension

Updated

Feb 27, 2024

Publisher Contextual Analysis

Trusted

Author: Chrome SettingsView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

600,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Get quick access to the main Chrome settings

The extension helps you save time and get to your Chrome Settings in one click. It also provides quick access to tabs, websites, privacy, cookies and other Google Chrome browser settings. You will be able to delete data in one or two clicks without constantly looking for where the function is located. To use the extension, install it from the official Chrome Web store by clicking on the blue "add" button. You can always contact us and tell us what features to add, so you will always be happy using our product.

User Growth

Showing data from Jun 25, 2022 to Jun 24, 2023

Versions

+1580.11%(+564,288 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical8

High3

Medium1

Low0

Versions scanned

Showing 2 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.1 Code review	7
1.0.1 Code review	5

Extension Version	Code Review Findings
1.2.1	7
1.0.1	5

Files with findings

4 distinct paths — top paths by unique finding count:

scripts/background.js6
rules1.json2
scripts/content-script.js2
scripts/default_settings.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	scripts/default_settings.js (line 144)	The `saveDefaultSettings` function dynamically injects arbitrary JavaScript strings as `<script>` elements directly into the `document.head` of every page visited. The content comes from extension storage (which is po…	1.2.1
2	Code Injection	critical	scripts/default_settings.js (line 11)	This code decodes a base64 payload from `postMessage`, turns it into a `<script>` element, and executes it directly in the visited page context. That is an explicit arbitrary code execution primitive, especially conce…	1.0.1
3	Data Exfiltration	critical	scripts/background.js (line 87)	The background service worker accepts arbitrary `endpoint` and `options` from page-injected scripts via the postMessage bridge and performs a `fetch()` to any URL on their behalf, returning the response back to the pa…	1.2.1
4	Network Interception	critical	rules1.json (line 1)	The extension statically strips `Content-Security-Policy` and `X-Frame-Options` response headers from every website the user visits (urlFilter: "*"). Removing CSP defeats XSS mitigations site operators have deployed, …	1.2.1
5	Network Interception	critical	rules1.json (line 1)	The extension strips `content-security-policy` and `x-frame-options` from every top-level page response. Removing those protections globally is a strong code-injection and clickjacking enabler because it weakens site …	1.0.1
6	Privilege Escalation	critical	scripts/content-script.js (line 1)	The content script creates an unrestricted postMessage bridge between the page's JavaScript context and the privileged extension context. Any script running in the page can send messages with the magic token `chromeSe…	1.2.1
7	Remote Code Loading	critical	scripts/background.js (line 20)	On every startup, the extension contacts `https://chrome-settings.online/defaultSettings/{uniqueUserId}` and applies whatever `netSettings` the server returns as dynamic `declarativeNetRequest` rules, completely repla…	1.2.1
8	Remote Code Loading	critical	scripts/background.js (line 4)	The extension registers every user's browser with Google Cloud Messaging (GCM) using a hardcoded sender ID (`476483741872`). This establishes a persistent bidirectional push channel from the attacker's server to the e…	1.2.1
9	Privilege Escalation	high	scripts/content-script.js (line 1)	The content script listens for `postMessage` from page scripts on every site and exposes extension storage values back to the page with `event.source.postMessage(..., '*')`. It also lets page context request storage-b…	1.0.1
10	Remote Code Loading	high	scripts/background.js (line 23)	The extension reads cookies from `https://chrome-settings.online`, extracts a `defaultSettings` value, and stores it locally for later use. Because another component forwards `defaultSettings` into a page-executed scr…	1.0.1
11	Tracking	high	scripts/background.js (line 20)	A persistent unique identifier (`chUId`) is generated and stored for each user, then included in every call to the remote server and in the uninstall tracking URL. This ID enables the operator to build per-user behavi…	1.2.1
12	Tracking	medium	scripts/background.js (line 4)	This code periodically calls a remote analytics endpoint with a unique extension/user identifier and also registers for GCM push messaging. The behavior is consistent with persistent user tracking and a remote command…	1.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.googleapis.com	-	https://fonts.googleapis.com
fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Inter:wght@500;800&display=swap
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
chrome-settings.online	/defaultSettings/	https://chrome-settings.online/defaultSettings/
chrome-settings.online	/uninstall/$%7Bresp.chUId%7D%60	https://chrome-settings.online/uninstall/${resp.chUId}`

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

I think the extension is great, however, the gear icon needs to be optional or at least movable, please. It becomes very inconvenient a lot of the time and for most sites there's an option at the top right of the page and it gets blocked. I have to disable the extension for the time being and I hope it gets updated in the future. I would definitely give it 5 stars if that happens.

Stephen Jungier·26 Nov 2023

Not really a fan of where you've placed the icon for this. It gets in the way and covers info on my screen. It should be in the Extensions part of the CHrome Toolbar only.

Ronnie Boone·24 Jul 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Settings for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating