smartUp Gestures

ID: bgjfekefhjemchdeigphccilhncnjldn

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese
🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇺🇸English
🇮🇹Italian
🇷🇺Russian

Extension Info & Metadata

Status
Removed
Version
7.3.0
Size
0.32 MB
Rating
4.5/5
Reviews
1,619
Users
90,000
Type
Extension
Updated
May 15, 2024
Category
Productivity Workflow
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
pramajitkumar911View Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
2
Active
0
Obsolete
2
Listed
2
Unlisted
0
Total Users
90,017

A customizable web browser extension that enhances productivity and efficiency through the use of mouse.

SmartUp Gestures is a mouse gesture extension that allows users to quickly perform various common actions while browsing the web using mouse gestures, thus enhancing productivity and efficiency. Users can customize different mouse gestures to execute different actions, such as forward/backward navigation, opening/closing tabs, scrolling pages, zooming in/out, create post on Facebook, etc... NOTE: After the initial installation is complete, the extension will redirect to a website that displays ads to promote and install other extensions provided by the sponsor. Additionally, there will be a small area on the options page that displays the sponsor's ad. Besides this, we will not insert or display advertisements anywhere else.

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
*://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 10% increase: About:blank access enables potential sandbox escape vectors
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
About:blank Access
Risk Factor
Medium
This extension can run content scripts in about:blank pages.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
tts
Permission
Low
This permission enables text-to-speech functionality. Rated Low because it can only convert visible text to speech without accessing sensitive data.

Fetches remote JSON (config + product/coupon list) from the developer-controlled server quan.zimoapps.com and pushes it into the content script to render an overlay on arbitrary pages. Because the payload drives on-page UI and outbound affiliate/coupon links, the operator can silently change what users see or click on any site — a classic monetization/affiliate-hijack vector and remote-content update channel outside the Web Store review process.

background.bundle.js (Line 4953)
tbkjx: {    getData: function(e, t, n) {      let s = "https://quan.zimoapps.com/push/tbkjx.json",        o = "https://quan.zimoapps.com/push/config.json?" + _.date.getTime();      fetch(o)        .then((e => e.json()))        .then((e => {          console.log(o), !g("tbkjx_dataversion") || Number(e.version) >= _.date.get() ? (s = s +              "?" + _.date.get()              .toString(), m("tbkjx_dataversion", e.version)) : s = s + "?" + g(              "tbkjx_dataversion"), console.log(s), fetch(s)            .then((e => e.json()))            .then((e => {              chrome.tabs.sendMessage(t.tab.id, {                type: "data",                value: e              })            }))        }))    },

Executes arbitrary user-stored JavaScript strings in the active tab via chrome.tabs.executeScript with `code:` and runAt document_start. Because the stored script list is a simple config blob that is synced via chrome.storage.sync and also written from options.js, any compromise of the synced config (or an attacker who can trigger the jsRun message) yields arbitrary code execution in the context of every page.

background.bundle.js (Line 4668)
jslist: {  jsRun: function(e) {    chrome.tabs.executeScript({      code: u.general.script.script[e.value].content,      runAt: "document_start"    })  }},

The extension wraps chrome.management.uninstall, setEnabled, and a disableAll helper that iterates every installed extension and disables them (except an allowlist). Combined with an optional `showConfirmDialog:false` path, this gives the extension the ability to silently disable or uninstall other installed extensions — e.g. security/antivirus add-ons — on behalf of a remote message, which is a privilege-escalation / defense-evasion capability not typical of a gesture extension.

background.bundle.js (Line 4794)
itemUninstall: function(e, t, n) {    chrome.management.uninstall(e.extId, {          showConfirmDialog: u.apps.extmgm.n_uninstallconfirm        }, (function(n) {            console.log("s"), chrome.management.getAll((function(n) {                    let s = [];                    ...                    disableAll: function(e, t, n) {                      chrome.management.getAll((function(e) {                        for (var t = 0; t < e.length; t++) e[t].id == _.extID || u.apps.extmgm.always && u.apps                          .extmgm.always.contains(e[t].id) || chrome.management.setEnabled(e[t].id, !1)                      }))                    }

The URL-shortener feature forwards the user's active tab URL (`t.url`) together with a hardcoded YOURLS signature to the developer-controlled endpoint url.zimoapps.com. This gives the operator a stream of browsing URLs tied to users who invoke the feature, and the shared static signature means any third party can also spam/abuse the same endpoint.

background.bundle.js (Line 4993)
shorturl: {    getURL: async function(e, t, n) {        console.log(e);        try {          let n = await fetch((u.apps.shorturl.n_suyourls ? "https://url.zimoapps.com/yourls-api.php" : u                .apps.shorturl.n_yourls + "/yourls-api.php") + "?action=shorturl&format=json&keyword=" + e              .value.key + "&url=" + encodeURIComponent(t.url) + "&signature=" + (u.apps.shorturl                .n_suyourls ? "ab279117c0" : u.apps.shorturl.n_sign), {                method: "POST"              }),            s = await n.json();

Uses declarativeNetRequest to overwrite the Origin and Referer headers on outbound requests so they appear to originate from https://www.google.com. Spoofing security-sensitive headers to bypass CORS/anti-CSRF origin checks is a known abuse pattern; even if the intent is reverse-image-search, the same rule can be triggered by any background fetch matching that filter.

background.bundle.js (Line 5216)
var v = [{  id: 1,  priority: 1,  action: {    type: "modifyHeaders",    requestHeaders: [{      header: "origin",      operation: "set",      value: "https://www.google.com"    }, {      header: "referer",      operation: "set",      value: "https://www.google.com/searchbyimage/upload"    }]  },  condition: {    urlFilter: "www.google.com/searchbyimage/upload",    resourceTypes: ["xmlhttprequest"],    tabIds: [chrome.tabs.TAB_ID_NONE]  }}];chrome.declarativeNetRequest.updateSessionRules({  addRules: v,  removeRuleIds: [1]})

Registers onMessageExternal using the same dispatch function as the internal onMessage handler without any sender.id allowlist. Every privileged action (extmgm disable/uninstall, jslist code execution, history/bookmark/sessions reads, downloads, shorturl/remote fetches) flows through funOnMessage, so any co-installed or injected extension that can reach this listener gets the same capabilities the extension itself has.

background.bundle.js (Line 5255)
chrome.runtime.onMessageExternal.addListener((function(e, t, n) {  _.funOnMessage(e, t, n)})), chrome.runtime.onMessage.addListener((function(e, t, n) {  _.funOnMessage(e, t, n)}))

pxmovie.getData performs fetch(e.value) where `e.value` is a URL passed in from the content script message. The background has host_permissions `<all_urls>` so it will happily fetch and parse any URL an attacker who can send that runtime message chooses, effectively turning the background into an SSRF/open proxy usable to reach intranet/file-protected endpoints with the extension's privileges.

background.bundle.js (Line 4821)
pxmovie: {    getList: function(e, t, n) {        fetch("https://www.poxiao.com/")          .then((e => e.blob()))          .then((e => {                var n = new FileReader;                n.onload = function(e) {                    var s = n.result;                    s = (new window.DOMParser)                      .parseFromString(s, "text/html"), console.log(s);                    ...                    getData: function(e, t, n) {                        fetch(e.value)                          .then((e => e.blob()))                          .then((e => {

By severity

Critical0
High3
Medium4
Low0

Versions scanned

Showing 1 of 17 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
7.3.07

Files with findings

1 distinct path — top paths by unique finding count:

  • background.bundle.js7
S.No.
Category
Severity
File
Summary
Found in Version
1Code Injection
high
background.bundle.js (line 4668)Executes arbitrary user-stored JavaScript strings in the active tab via chrome.tabs.executeScript with `code:` and runAt document_start. Because the stored script list is a simple config blob that is synced via chrome…
2Privilege Escalation
high
background.bundle.js (line 4794)The extension wraps chrome.management.uninstall, setEnabled, and a disableAll helper that iterates every installed extension and disables them (except an allowlist). Combined with an optional `showConfirmDialog:false`…
3Remote Code Loading
high
background.bundle.js (line 4953)Fetches remote JSON (config + product/coupon list) from the developer-controlled server quan.zimoapps.com and pushes it into the content script to render an overlay on arbitrary pages. Because the payload drives on-pa…
4Network Interception
medium
background.bundle.js (line 5216)Uses declarativeNetRequest to overwrite the Origin and Referer headers on outbound requests so they appear to originate from https://www.google.com. Spoofing security-sensitive headers to bypass CORS/anti-CSRF origin …
5Network Interception
medium
background.bundle.js (line 4821)pxmovie.getData performs fetch(e.value) where `e.value` is a URL passed in from the content script message. The background has host_permissions `<all_urls>` so it will happily fetch and parse any URL an attacker who c…
6Privilege Escalation
medium
background.bundle.js (line 5255)Registers onMessageExternal using the same dispatch function as the internal onMessage handler without any sender.id allowlist. Every privileged action (extmgm disable/uninstall, jslist code execution, history/bookmar…
7Unauthorized Data Collection
medium
background.bundle.js (line 4993)The URL-shortener feature forwards the user's active tab URL (`t.url`) together with a hardcoded YOURLS signature to the developer-controlled endpoint url.zimoapps.com. This gives the operator a stream of browsing URL…
URLs
55
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

developer.chrome.com/extensions/permission_warningshttps://developer.chrome.com/extensions/permission_warnings
developer.mozilla.org/Add-ons/WebExtensions/API/browserSettings.https://developer.mozilla.org/Add-ons/WebExtensions/API/browserSettings.
developer.chrome.com/extensions/permission_warnings%E3%80%82https://developer.chrome.com/extensions/permission_warnings。
developer.mozilla.org/Add-ons/WebExtensions/API/browserSettings%E3%80%82https://developer.mozilla.org/Add-ons/WebExtensions/API/browserSettings。
github.com/uuidjs/uuidhttps://github.com/uuidjs/uuid#getrandomvalues-not-supported
www.google.com/searchhttps://www.google.com/search?q=%s
www.bing.com/searchhttps://www.bing.com/search?q=%s
lens.google.com/uploadbyurlhttps://lens.google.com/uploadbyurl?url=%s
www.bing.com/images/searchhttps://www.bing.com/images/search?q=imgurl:%s
www.baidu.com/shttps://www.baidu.com/s?wd=%s
Showing 1 to 10 of 60 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 10 of 20 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.