Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Sigma Adblock

CRITICAL RISKRemoved from Chrome Web Store

Sigma Adblock

ID: gkhnanmhgeggclieoggjehkloolfkbdo

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1.9

Size

0.64 MB

Rating

4.5/5

Reviews

104

Users

1,514,090

Type

Extension

Updated

Oct 27, 2020

Publisher Contextual Analysis

Author: Ernie RobertsView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

2,851,578

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Relentless and easy to use adblocker

Sigma Adblock is an adblock software that removes all kinds of ads. Features: ⭐ Adblocking - we use curated and well-tested ad-blocking filter lists. We update filters frequently. ⭐ Easy setup - we detect your location and apply filters based on your country. ⭐ Anti-anti-adblock - we prevent websites from detecting adblocking software. Please note: It won’t work in every possible case.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium6

Low1

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.9 Code review	4
1.1.8 Code review	7

Extension Version	Code Review Findings
1.1.9	4
1.1.8	7

Files with findings

4 distinct paths — top paths by unique finding count:

bg.js6
content.js3
manifest.json1
subscriptions.xml1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	bg.js (line 6)	The extension's notification endpoint is hard-coded to a third-party server (cdn.easyadblocker.com) rather than Adblock Plus's official servers. The internal addonVersion is '0.9.5' while the manifest declares version…	1.1.8
2	Remote Code Loading	critical	subscriptions.xml (line 3)	All 23 filter list subscriptions (including EasyList, EasyPrivacy, regional lists) are proxied through rules.easyadblocker.com instead of their official sources (easylist.to, etc.). The operator fully controls what fi…	1.1.8
3	Network Interception	high	bg.js (line 6)	The extension intercepts and modifies Content-Security-Policy response headers across all HTTP/HTTPS traffic using webRequestBlocking. While this is used by ad blockers for CSP-based ad blocking, when combined with op…	1.1.8
4	Tracking	high	bg.js (line 6)	Every filter list and notification download appends telemetry (addon name, version, browser type, platform, and download count) as query parameters to ALL outbound requests. These requests go to operator-controlled se…	1.1.8
5	Code Injection	medium	content.js (line 1101)	This content script injects executable source into page and frame contexts using `eval()` at `document_start`. Even if intended for WebRTC filtering, it bypasses normal content-script isolation and executes generated …	1.1.9
6	Code Injection	medium	content.js (line 4)	The content script uses contentWindow.eval() to inject the 'injected' function into every iframe and frame on every visited page. While the stated purpose is WebRTC leak prevention, executing dynamic eval-constructed …	1.1.8
7	Code Injection	medium	content.js (line 4)	The content script dynamically constructs a Blob URL containing the 'injected' function body as a string and injects it as a <script> tag directly into the document DOM, bypassing content script isolation. This techni…	1.1.8
8	Network Interception	medium	bg.js (line 10637)	The background script intercepts every non-main-frame request on `<all_urls>` and can cancel them before they leave the browser. This gives the extension full visibility into browsing traffic and active control over n…	1.1.9
9	Network Interception	medium	bg.js (line 13390)	This listener rewrites response headers and injects a `Content-Security-Policy` into visited pages based on filter matches. Modifying CSP at the network layer can suppress site scripts and change page behavior globall…	1.1.9
10	Tracking	medium	manifest.json (line 1)	The extension's own Content Security Policy explicitly whitelists Google Analytics and Google Tag Manager domains for script execution within the extension's pages. No corresponding GA/GTM code was found in the curren…	1.1.8
11	Tracking	low	bg.js (line 9880)	On repeated subscription download failures, the extension sends a background GET request to a fallback URL containing the extension version, subscription URL, failing download URL, and error/status details. That is a …	1.1.9

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rules.easyadblocker.com	/easylist.txt	https://rules.easyadblocker.com/easylist.txt
easylist.to	-	https://easylist.to/
rules.easyadblocker.com	/abpindo+easylist.txt	https://rules.easyadblocker.com/abpindo+easylist.txt
abpindo.blogspot.com	-	http://abpindo.blogspot.com/
rules.easyadblocker.com	/abpvn+easylist.txt	https://rules.easyadblocker.com/abpvn+easylist.txt
abpvn.com	-	http://abpvn.com/
rules.easyadblocker.com	/bulgarian_list+easylist.txt	https://rules.easyadblocker.com/bulgarian_list+easylist.txt
stanev.org	/abp/	http://stanev.org/abp/
rules.easyadblocker.com	/easylistchina+easylist.txt	https://rules.easyadblocker.com/easylistchina+easylist.txt
abpchina.org	/forum/	http://abpchina.org/forum/

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Excelente servicio

Sr Gamer·14 Jan 2021

Got rid of ads on all the sites I use so far! Would recommend.

Ethan O'Connor·13 Jan 2021

keren parah!!

Kozakura·13 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Sigma Adblock

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews