Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: SMSfromBrowser

CRITICAL RISKRemoved from Chrome Web Store

SMSfromBrowser

ID: mfgpancdbihmofnapdphhffdcfjkoljc

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇯🇵Japanese

🇲🇽Latin American Spanish

🇵🇹Portuguese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

13.986.19.62920

Size

0.39 MB

Rating

2.4/5

Reviews

Users

216,171

Type

Extension

Updated

Apr 14, 2021

Publisher Contextual Analysis

Author: http://smsfrombrowser.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

216,171

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Send SMS and text messages directly from your computer with this Chrome New Tab Extension.

Get SMSfromBrowser, access PC to mobile messaging and communicate with your friends, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! Free services accessed from SMSfromBrowser may require payment to access premium features. By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested : "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Log: 13.962 : Optimizes the sync of this extension between Chrome profiles.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High13

Medium2

Low0

Versions scanned

Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
13.958.19.40266 Code review	12
13.958.19.9344 Code review	5

Extension Version	Code Review Findings
13.958.19.40266	12
13.958.19.9344	5

Files with findings

13 distinct paths — top paths by unique finding count:

js/extensionDetect.js2
js/localStorageContentScript.js2
js/ul.js2
js/watchExtensionsHandler.js2
config/config.json1
js/B2BService.js1
js/babRemoteConfigProcessor.js1
js/babTypeInjectionScript.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	js/babRemoteConfigProcessor.js (line 14)	After fetching a remote config from a server-controlled URL (`babConfigUrl`), the extension creates a hidden `<iframe>` in the background page whose `src` is set to `babConfig.proxyUrl` — a URL defined entirely by the…	13.958.19.40266
2	Tracking	critical	js/extensionDetectWithHash.js (line 55)	On every completed navigation, the extension scans ALL frames of ALL tabs using `chrome.webNavigation.getAllFrames` looking for URL hash parameters matching its tracking pattern (`pp=`). When found, it fires a `Toolba…	13.958.19.40266
3	Code Injection	high	js/background.js (line 479)	The background script dynamically injects `extensionDetect.js` (at `document_start`) and `webTooltabAPIProxy.js` into any tab navigating to `*.smsfrombrowser.com`. These injections are not declared in the manifest und…	13.958.19.40266
4	Data Exfiltration	high	js/extensionDetect.js (line 94)	This content script, injected into `*.smsfrombrowser.com` pages, listens to `window.postMessage` events and responds to `GET_INFO` requests by exposing the user's internal toolbarId, partnerId, partnerSubId, and insta…	13.958.19.40266
5	Other	high	js/dailyContentService.js (line 205)	The DailyContentService is scheduled via Chrome alarms to fire every day at 2:00 AM and forcibly open a new browser window pointing to the extension's new-tab page (an ad-serving page at hp.myway.com). This is an adwa…	13.958.19.40266
6	Remote Code Loading	high	js/babTypeInjectionScript.js (line 52)	This code executes arbitrary JavaScript stored in `_this.remoteScript` directly into tabs at `document_start`. In the same file, `_this.remoteScript` is populated from `extensionConfig.buildVars.babRemoteScriptUrl`, w…	13.958.19.9344
7	Tracking	high	js/ul.js (line 23)	Every 6 hours (and at startup), the extension fires a `ToolbarActive` GET request to `https://live.tb.ask.com/tr.gif` containing: toolbarId (unique per-user UUID), partnerId, partnerSubId, buildDate, coId, userSegment…	13.958.19.40266
8	Tracking	high	js/offerService.js (line 277)	The OfferService assembles a rich browser fingerprint — OS, browser name and version, userAgent string, language, locale, navigator.platform, plus unique tracking IDs — and sends it via PUT request to a remotely-confi…	13.958.19.40266
9	Tracking	high	js/B2BService.js (line 4)	The B2BService fires a covert pixel beacon to `https://tbapi.search.ask.com/tb/analytics` every 8 hours using `new Image().src` (a tracking technique that bypasses normal request inspection), transmitting: unique tool…	13.958.19.40266
10	Tracking	high	config/config.json (line 15)	The config defines install pixel/conversion URL templates (dlp1/dlp2) that embed the user's partnerId, partnerSubId, coId, toolbarId, countryCode, and campaign data — fired immediately upon install. These are affiliat…	13.958.19.40266
11	Tracking	high	js/extensionDetect.js (line 102)	This injected page script exposes extension identifiers and install metadata to page JavaScript via a `GET_INFO` message flow, and it also plants cookies that mark the extension as installed. That creates a site-visib…	13.958.19.9344
12	Unauthorized Data Collection	high	js/dlp.js (line 229)	The extension calls `chrome.cookies.getAll({ domain: '.smsfrombrowser.com' })` to harvest all cookies from its domain and then serializes them to JSON. The collected data (partnerId, toolbarId, installDate, countryCod…	13.958.19.40266
13	Unauthorized Data Collection	high	js/watchExtensionsHandler.js (line 1)	The extension uses `chrome.management.getAll()` to enumerate all installed extensions, collecting their IDs, versions, and enabled state. It then registers persistent listeners for install, uninstall, enable, and disa…	13.958.19.40266
14	Unauthorized Data Collection	high	js/localStorageContentScript.js (line 9)	This content script is injected into `download.smsfrombrowser.com/blank.jhtml` and opens a messaging channel back to the background page. On command, it reads either specific keys or ALL keys from `window.localStorage…	13.958.19.40266
15	Unauthorized Data Collection	high	js/localStorageContentScript.js (line 7)	This content script can dump every key from `window.localStorage` and send the values back to the extension over a runtime port. Because the manifest injects this script into `https://download.smsfrombrowser.com/blank…	13.958.19.9344
16	Tracking	medium	js/ul.js (line 7)	The extension builds telemetry payloads containing persistent identifiers such as `toolbarId`, `partnerId`, `partnerSubId`, `coid`, and `userSegment`. Elsewhere in the same file, `fireEvent()` sends this object with `…	13.958.19.9344
17	Unauthorized Data Collection	medium	js/watchExtensionsHandler.js (line 27)	This code enumerates other installed extensions with `chrome.management.getAll()` and records their IDs, versions, and enabled state when they have monitored permissions such as `newTabPageOverride`. Inventorying comp…	13.958.19.9344

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

179

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ak.staticimgfarm.com	/images/webtooltab/assets/logos/	https://ak.staticimgfarm.com/images/webtooltab/assets/logos/
35.190.68.37	-	http://35.190.68.37
localhost	-	http://localhost:8080
api.dynamicbuttons.vicinio.com	-	https://api.dynamicbuttons.vicinio.com
ak.staticimgfarm.com	/images/webtooltab/assets/searchbar/green_magnifying_glass.png	https://ak.staticimgfarm.com/images/webtooltab/assets/searchbar/green_magnifying_glass.png
iac_banner.tiles.ampfeed.com	-	https://iac_banner.tiles.ampfeed.com
www.accuweather.com	/coronavirus	https://www.accuweather.com/coronavirus?partner=web_askapp_adc
ak.staticimgfarm.com	/images/webtooltab/assets/down-arrow.png	https://ak.staticimgfarm.com/images/webtooltab/assets/down-arrow.png
ak.staticimgfarm.com	/images/webtooltab/assets/searchbar/223754551.png	https://ak.staticimgfarm.com/images/webtooltab/assets/searchbar/223754551.png
eula.askapplications.com	/eula/	https://eula.askapplications.com/eula/

Showing 1 to 10 of 180 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


35.190.68.37	IPv4	-

1.6 out of 5 · 7 most recent reviews

Text reviews

Positive

Negative

it wont install on my device its TRASH dont use it

Toni Brown·31 Dec 2020

it wont let me in

Elaina Shaw·27 Oct 2020

i wont let me in

erick concepcion·9 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

SMSfromBrowser

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions17

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews