Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Sound Booster Plus

CRITICAL RISKRemoved from Chrome Web Store

Sound Booster Plus

ID: ipmlaaecoiapbecaaalooaocfkkmkbdh

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.1.5

Size

0.20 MB

Rating

4.8/5

Reviews

621

Users

115,615

Type

Extension

Updated

Apr 19, 2023

Publisher Contextual Analysis

Trusted

Author: https://volumebooster.phView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

115,615

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Increase system volume up to 1000% from the maximum level! Boost your system sound.

The Sound Booster is an extension that will allow you to increase the sound of your system. It can raise volume level up to 1000%. Features: - Increase the volume of the content being played up to 1000% - Works on all sites - Enable/Disable with single click How to use Sound booster Chrome extension: 1. Install the extension 2. Pin it in the toolbar 3. Click on the extension icon and enable the volume booster with toggle button. 4. Then, click on the extension icon and choose the Sound boost range. Recent Changes: Version 1.1.6 (24-September-2022): - Minor bug fix Version 1.1.4 (06-September-2022): - Bug fix - Improved UI Best Volume Master alternative. **Note: Please reload tabs after installing the extension to make it work.**

User Growth

Showing data from Sep 07, 2022 to Apr 28, 2023

Versions

+41.42%(+33,860 users)

Compared to 3 months ago

10 versions released in this period

Rating Count

Total: 621 ratings+21 (4%)

Average Rating

Current: 4.83 / 5.0+4.83

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium0

Low1

Versions scanned

Showing 1 of 10 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.7 Code review	9

Extension Version	Code Review Findings
1.1.7	9

Files with findings

2 distinct paths — top paths by unique finding count:

js/bg.js8
js/cs.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/cs.js (line 7530)	The content script (running on <all_urls>) listens for an 'sksmode:aurl' message and injects a hidden iframe with an attacker-controlled URL into the host page's <head>, with allow-same-origin+allow-scripts+allow-form…	1.1.7
2	Network Interception	critical	js/bg.js (line 90)	Uses declarativeNetRequest to strip X-Frame-Options, Frame-Options, and Content-Security-Policy response headers on main_frame/sub_frame/script requests. Removing CSP and frame-busting headers enables arbitrary third-…	1.1.7
3	Remote Code Loading	critical	js/bg.js (line 141)	Listens for Google Cloud Messaging (GCM) push messages from sender ID 442925115938 and acts on attacker-supplied JSON: if the link contains 'oibww' it silently injects the URL into a user's open tab as an iframe (via …	1.1.7
4	Code Injection	high	js/bg.js (line 267)	On install/update the extension force-injects cs.js into every currently open tab (across all http/https/file URLs) rather than waiting for natural navigation. This guarantees immediate reach of the iframe-injection m…	1.1.7
5	Data Exfiltration	high	js/bg.js (line 221)	On startup the extension generates a random 8-char 'extid', registers for GCM push with the operator's sender ID, and exfiltrates the (extid, gcmid) pair to volumebooster.ph/v3/regcm.php. This registers every user wit…	1.1.7
6	Network Interception	high	js/bg.js (line 213)	A dynamic declarativeNetRequest rule spoofs the Referer header to 'https://chrome-extension.installed' for the voluebooster.ph domain. Forging Referer headers is a common affiliate-fraud / ad-attribution-laundering te…	1.1.7
7	Tracking	high	js/bg.js (line 234)	On every tab completion the extension uses chrome.scripting.executeScript against <all_urls> to read document.referrer from the loaded page. Harvesting referrer data for every page a user visits is browsing-history tr…	1.1.7
8	Unauthorized Data Collection	high	js/bg.js (line 54)	Background service worker fetches geolocation (country, city, zip) from a third-party IP geolocation API over cleartext HTTP and persists it to extension storage. This is unauthorized geographic profiling of users, un…	1.1.7
9	Tracking	low	js/bg.js (line 283)	Sets an uninstall URL that opens volumebooster.ph/uninstall on removal, which together with the extid registration enables the operator to correlate installs with uninstalls and track individual-user extension lifecyc…	1.1.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ip-api.com	/json	http://ip-api.com/json
*	/*	http:///
*	/*	https:///
volumebooster.ph	/image/pushlogo.png	https://volumebooster.ph/image/pushlogo.png?v=
api.volumebooster.ph	/deal/	https://api.volumebooster.ph/deal/
volumebooster.ph	-	https://volumebooster.ph/
bit.ly	/41ugiEx	https://bit.ly/41ugiEx
volumebooster.ph	//uninstall	https://volumebooster.ph//uninstall
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Superb It's Worked

Jothivel K·27 Apr 2023

Tidak permanen

Fahar Raditya·27 Apr 2023

love it

Shafali rana·27 Apr 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Sound Booster Plus

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 10 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating