Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Smooth Keyboard - Virtual Keyboard

CRITICAL RISKRemoved from Chrome Web Store

Smooth Keyboard - Virtual Keyboard

ID: edailiddamlkedgjaoialogpllocmgjg

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.7.8

Size

0.23 MB

Rating

4.3/5

Reviews

Users

600,000

Type

Extension

Updated

Feb 23, 2022

Publisher Contextual Analysis

Author: robert9014View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

600,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Smooth keyboard - virtual keyboard for secure typing, touch devices, Chromebook.

Smooth Keyboard is an on-screen virtual keyboard. You can input text using a touch screen or mouse. Features: ⭐ Full-screen keyboard or mini version ⭐ Go to URL panel ⭐ On-demand or Always-on mode ⭐ Languages: English, French, German, Polish, Russian, Italian, Korean, Magyar, Norwegian, Slovenian, Spanish, Swedish, Tamil

User Growth

Showing data from Jan 01, 2022 to Mar 02, 2022

Versions

+50%(+200,000 users)

Compared to 2 months ago

3 versions released in this period

Rating Count

Total: 11 ratings

Average Rating

Current: 4.27 / 5.0-0.33

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High4

Medium3

Low0

Versions scanned

Showing 2 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.7.4 Code review	4
0.7.3 Code review	7

Extension Version	Code Review Findings
0.7.4	4
0.7.3	7

Files with findings

5 distinct paths — top paths by unique finding count:

background.js5
js/script.js3
js/options.js1
js/toggle.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/script.js (line 1)	The `setting_load` function takes a `callback` parameter as a string and passes it directly to `eval()`, then immediately invokes the resulting function with data retrieved from `localStorage` via the background page.…	0.7.3
2	Credential Theft	critical	js/script.js (line 1)	The extension forcibly changes the type of input fields — including any field that is NOT already `password` type — to `text`. More critically, it saves the `_originalType` attribute and checks for `password` type, me…	0.7.3
3	Privilege Escalation	critical	background.js (line 506)	This helper walks remote-supplied object entries, resolves arbitrary property paths, parses remote JSON arguments, and invokes bound functions against the Chrome API object. Combined with the remote fetch above, it en…	0.7.4
4	Remote Code Loading	critical	background.js (line 183)	This code obfuscates a remote URL, fetches JSON from that server, and immediately passes the response into `wrapObject(chrome, OJ)`. That gives a remote endpoint influence over privileged extension behavior at runtime…	0.7.4
5	Code Injection	high	js/options.js (line 1)	The `callFunc` function blindly `eval`s its string argument and calls the result as a function. It is invoked from the options page with values from HTML `_changed` attributes, but the manifest CSP explicitly permits …	0.7.3
6	Code Injection	high	js/toggle.js (line 1)	The `goToUrl` click handler calls `eval(callback)` where `callback` is never defined in scope — this will throw a `ReferenceError` at runtime, indicating either a shipped bug or a placeholder for a not-yet-removed exf…	0.7.3
7	Tracking	high	background.js (line 28)	The background page injects and executes a remote script from Google Analytics instead of bundling code locally. That introduces externally hosted executable code into the extension and also sends telemetry from the p…	0.7.4
8	Tracking	high	background.js (line 1)	The background page initializes Google Analytics (UA-203071121-1) and explicitly sets `checkProtocolTask` to `null` — a known technique to suppress GA's protocol validation check so it fires inside a `chrome-extension…	0.7.3
9	Code Injection	medium	manifest.json (line 1)	The manifest Content Security Policy explicitly includes `'unsafe-eval'`, which permits `eval()`, `new Function()`, and similar dynamic code execution across all extension pages. This CSP is intentionally weakened — t…	0.7.3
10	Credential Theft	medium	js/script.js (line 293)	This content script rewrites focused inputs to `type = "text"` across all matched pages, including fields whose original type may be `password`. The extension is installed on `<all_urls>`, so it can expose credentials…	0.7.4
11	Privilege Escalation	medium	background.js (line 1)	On first install, the extension iterates over ALL currently open browser tabs and programmatically injects `script.js` into every non-chrome tab via `chrome.tabs.executeScript`, before the user has a chance to configu…	0.7.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
jquery.com	-	https://jquery.com/
sizzlejs.com	-	https://sizzlejs.com/
jquery.org	/license	https://jquery.org/license
github.com	/whatwg/html/issues/2369	https://github.com/whatwg/html/issues/2369
html.spec.whatwg.org	-	https://html.spec.whatwg.org/#nonce-attributes
js.foundation	-	https://js.foundation/

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

No Ukrainian layout

АА

Андрій Андр·11 Jan 2022

No Ukrainian layout

А�

Андрій ��ндр·11 Jan 2022

It is a good virtual keyboard. I tried it, Everything is great.

VIktoria Martin·10 Nov 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Smooth Keyboard - Virtual Keyboard

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews