Security Alert: Confirmed Malware
SMSfromBrowser
ID: mfgpancdbihmofnapdphhffdcfjkoljc
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- http://smsfrombrowser.comView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Send SMS and text messages directly from your computer with this Chrome New Tab Extension.
Get SMSfromBrowser, access PC to mobile messaging and communicate with your friends, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! Free services accessed from SMSfromBrowser may require payment to access premium features. By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested : "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Log: 13.962 : Optimizes the sync of this extension between Chrome profiles.
This code executes arbitrary JavaScript stored in `_this.remoteScript` directly into tabs at `document_start`. In the same file, `_this.remoteScript` is populated from `extensionConfig.buildVars.babRemoteScriptUrl`, which creates a dormant remote-code-loading path where server-side content can become executable extension-delivered code.
this.initRemoteScript(extensionConfig);return function(tab) { ask.apps.ul.fireInfoEvent(extensionConfig.buildVars.unifiedLoggingUrl, { message: "browser-action-clicked", topic: "browser-action" }, extensionConfig, "BAB") .catch(Logger.log); if (_this.handleSubsequentBabClicks(tab, getConnection)) return; BabClickHandler.getInjectionDetails(tab, extensionConfig.buildVars.newTabURL) .then(function(injectDetailsArr) { var remoteScriptInjectionDetails = { code: _this.remoteScript, runAt: "document_start" }; if (injectDetailsArr.length && injectDetailsArr[0].frameId) { remoteScriptInjectionDetails.frameId = injectDetailsArr[0].frameId; } return Promise.all([ Util.injectScriptsSequentially(tab.id, injectDetailsArr, extensionConfig, { message: "failed-inject-babContentScript lastError", topic: "browser-action" }), new Promise(function(resolve) { chrome.tabs.executeScript(tab.id, remoteScriptInjectionDetails, resolve); }) ]);This content script can dump every key from `window.localStorage` and send the values back to the extension over a runtime port. Because the manifest injects this script into `https://download.smsfrombrowser.com/blank.jhtml`, it provides a mechanism for the extension to silently harvest data stored on that remote domain.
var portNamePrefix = "localStorageContentScript";var channel;var commands = { getLocalStorage: function(data) { var storage = window.localStorage; var keys = data && data.keys && data.keys.length ? data.keys : Object.keys(storage); return Promise.resolve(keys.reduce(function(p, key) { p[key] = storage.getItem(key); return p; }, {})); }};function init() { var port = chrome.runtime.connect({ name: Util.generateGuid2(portNamePrefix + "-" + chrome.runtime.id + "-") }); channel = { id: port.name, port: port, callbacks: new Map() }; port.onMessage.addListener(onConnectMessage);}ContentScript.init = init;This injected page script exposes extension identifiers and install metadata to page JavaScript via a `GET_INFO` message flow, and it also plants cookies that mark the extension as installed. That creates a site-visible tracking channel on `.smsfrombrowser.com` pages, allowing the website to detect and correlate installed-extension state with a unique toolbar ID.
function getCommands(configData) { return { GET_INFO: function(reply) { reply({ toolbarId: configData.state.toolbarData.toolbarId, partnerId: configData.state.toolbarData.partnerId, partnerSubId: configData.state.toolbarData.partnerSubId, installDate: configData.state.toolbarData.installDate, toolbarVersion: configData.buildVars.version, toolbarBuildDate: configData.buildVars.buildDate, }); } };}function setInstalledCookies(toolbarId) { var hourFromNow = new Date(Date.now() + (1 * 60 * 60 * 1000)) .toUTCString(); document.cookie = "mindsparktb_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/"; document.cookie = "mindsparktbsupport_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/";}The extension builds telemetry payloads containing persistent identifiers such as `toolbarId`, `partnerId`, `partnerSubId`, `coid`, and `userSegment`. Elsewhere in the same file, `fireEvent()` sends this object with `AJAX.get()` to remote logging URLs, making this a structured tracking/exfiltration mechanism rather than incidental debugging.
function createStandardData(eventName, config) { return { anxa: "CAPNative", anxv: config.buildVars.version, anxe: eventName, anxt: config.state.toolbarData.toolbarId, anxtv: config.buildVars.version, anxp: config.state.toolbarData.partnerId, anxsi: config.state.toolbarData.partnerSubId, anxd: config.buildVars.buildDate, f: "00400000", anxr: +new Date(), coid: config.state.toolbarData.coId || config.buildVars.coId, userSegment: config.state.toolbarData.userSegment };}This code enumerates other installed extensions with `chrome.management.getAll()` and records their IDs, versions, and enabled state when they have monitored permissions such as `newTabPageOverride`. Inventorying competing extensions is a common adware/toolbar behavior and is difficult to justify for the advertised SMS functionality.
chrome.management.getAll(function(extensionInfos) { var watchExtensions = getEmptyWatchExtensionsObject(); extensionInfos .filter(function(eInfo) { return eInfo.type === "extension" && eInfo.id !== chrome.runtime.id && Util.checkOverlap(eInfo.permissions, WatchExtensionsHandler.permissionsToMonitor); }) .forEach(function(eInfo) { WatchExtensionsHandler.permissionsToMonitor .filter(function(monitorPermission) { return ~eInfo.permissions.indexOf(monitorPermission); }) .forEach(function(permission) { watchExtensions[permission].stackOfExtensions.push({ id: eInfo.id, version: eInfo.version, enabled: eInfo.enabled }); }); }); Object.keys(watchExtensions)By severity
Versions scanned
Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 13.958.19.40266 | 12 |
| 13.958.19.9344 | 5 |
Files with findings
13 distinct paths — top paths by unique finding count:
- js/extensionDetect.js2
- js/localStorageContentScript.js2
- js/ul.js2
- js/watchExtensionsHandler.js2
- config/config.json1
- js/B2BService.js1
- js/babRemoteConfigProcessor.js1
- js/babTypeInjectionScript.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.