Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Subway Surfers

CRITICAL RISKRemoved from Chrome Web Store

Subway Surfers

ID: oolehmnnaggcbnlplpccgholfbdlpbel

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.5

Size

25.23 MB

Rating

4.0/5

Reviews

Users

5,000

Type

Extension

Updated

Apr 22, 2024

Publisher Contextual Analysis

Trusted

Author: Premium GamesView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

15,292

Email Change History

1 change

Apr 5, 2024

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Subway Surfers World Tour: San Francisco. Play Subway Surfers endless runner game

Subway Surfers is an exhilarating and fast-paced endless runner game that has captivated players worldwide on mobile devices. Now, with "Subway Surfers World Tour: San Francisco" available for desktop browsers, the excitement and fun are taken to a whole new level. Here's why you'll enjoy playing this thrilling game on your desktop: - Bigger Screen, More Detail: Playing Subway Surfers on your desktop provides a larger screen experience, allowing you to appreciate the game's vibrant graphics and intricate details even more. - Precise Controls: Desktop browsers offer precise control through keyboard inputs, making it easier to navigate your character through the intricate subway landscapes of San Francisco. - Endless Running Thrills: Just like in the mobile version, you'll be challenged to run, jump, and surf across subway tracks and rooftops endlessly. The game's simple yet addictive mechanics will keep you engaged for hours. - Collectibles and Power-Ups: Collect coins and power-ups to boost your performance and score. Unlock new characters and hoverboards as you progress, adding variety and excitement to the gameplay. - San Francisco Adventure: Explore the iconic city of San Francisco as your backdrop. Dodge oncoming trains, dash through cable cars, and leap across the famous Golden Gate Bridge as you immerse yourself in this thrilling urban adventure. - Compete with Friends: Challenge your friends and fellow players to beat your high score. Subway Surfers fosters a competitive spirit, and achieving the highest score is always rewarding. In "Subway Surfers World Tour: San Francisco," you'll experience the rush of urban parkour, vibrant visuals, and heart-pounding action, all on the convenience of your desktop browser. It's the perfect way to enjoy the game's fun and challenge in a larger format. So, jump on your virtual skateboard and start running through the iconic streets of San Francisco in this thrilling endless runner adventure!

User Growth

Showing data from Oct 02, 2023 to Apr 23, 2024

Versions

+984.6%(+4,539 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 4 ratings+2 (100%)

Average Rating

Current: 4.00 / 5.0+4.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2 Code review	5

Extension Version	Code Review Findings
1.0.2	5

Files with findings

3 distinct paths — top paths by unique finding count:

manifest.json2
storage.js2
img.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	storage.js (line 34)	The parent-side `setupParent()` persists intercepted cookie and localStorage data to `chrome.storage.local` (durable extension storage) and continuously re-broadcasts it to the iframe every 1000ms via `postMessage` wi…	1.0.2
2	Unauthorized Data Collection	high	manifest.json (line 10)	The extension declares a content script (img.js) that runs on every HTTPS page the user visits (`https:///`) at `document_start`, the earliest possible execution point. This is entirely unnecessary for a game extens…	1.0.2
3	Unauthorized Data Collection	high	img.js (line 1)	This file is injected as a content script into every HTTPS page at document_start, yet it contains a banner-ad injection framework: it fetches an ad payload (URL + image) from response object `r` and injects a fixed-p…	1.0.2
4	Unauthorized Data Collection	high	storage.js (line 1)	The script overrides the native `document.cookie` property via `Object.defineProperty`, intercepting all cookie reads and writes within the sandboxed page. Any cookie value longer than 100 characters is captured and i…	1.0.2
5	Code Injection	medium	manifest.json (line 21)	The sandbox CSP allows `'unsafe-eval'` and `'unsafe-inline'` across every directive (script-src, object-src, child-src, worker-src, script-src-elem). This permits arbitrary dynamic code generation via `eval()`, `new F…	1.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/html	http://www.w3.org/1999/html
www.ascendercorp.com	/http://www.ascendercorp.com/typedesigners.htmlhttp://www.ascendercorp.com/typedesigners.htmlLicensed	http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlhttp://www.ascendercorp.com/typedesigners.htmlLicensed
scripts.sil.org	/OFL%EF%BF%BD	http://scripts.sil.org/OFL�
subway.azureedge.net	/subway/androidgenerated.bytesRepeated	http://subway.azureedge.net/subway/androidgenerated.bytesRepeated
graph.facebook.com	/%7B0%7D/picture	http://graph.facebook.com/{0}/picture?width=64&height=64FetchNextTournament:
docs.poolmanager.path-o-logical.comspawnpool	-	http://docs.poolmanager.path-o-logical.comSpawnPool
www.microsoft.com	/xml/security/algorithm/PKCS1-v1.5-KeyEx	http://www.microsoft.com/xml/security/algorithm/PKCS1-v1.5-KeyEx
www.microsoft.com	/xml/security/encryption/v1.0	http://www.microsoft.com/xml/security/encryption/v1.0
schemas.microsoft.com	/clr/nsassem/http://schemas.microsoft.com/clr/ns/Total	http://schemas.microsoft.com/clr/nsassem/http://schemas.microsoft.com/clr/ns/Total
kiloo.com	/support/subway-surfers/DetachPlatformsAsync:	http://kiloo.com/support/subway-surfers/DetachPlatformsAsync:

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


4.0.0.0	IPv4	-
0.14.0.24	IPv4	-
0.34.0.44	IPv4	-
14.24.34.4	IPv4	-
4.14.4.24	IPv4	-
4.34.4.45	IPv4	-
2.5.29.192	IPv4	-
5.29.152.5	IPv4	-
29.142.5.29	IPv4	-
1.1.51.2	IPv4	-
1.1.41.2	IPv4	-
4.31.3.14	IPv4	-
1.1.21.2	IPv4	-
1.1.31.3	IPv4	-
1.101.2.1	IPv4	-
1.191.3.14	IPv4	-
1.101.3.4	IPv4	-
1.1.111.2	IPv4	-
1.1.121.2	IPv4	-
1.1.131.2	IPv4	-
1.1.101.2	IPv4	-
4.3.21.2	IPv4	-
4.3.31.2	IPv4	-
4.3.41.2	IPv4	-
1.1.11.2	IPv4	-
1.7.11.2	IPv4	-
1.9.31.2	IPv4	-
1.9.41.2	IPv4	-
1.9.51.2	IPv4	-
3.14.3.2	IPv4	-
151.3.14.3	IPv4	-
2.31.3.14	IPv4	-
3.2.131.3	IPv4	-
14.7.2.3	IPv4	-
3.36.3.2	IPv4	-
1.9.16.3	IPv4	-
61.3.14.3	IPv4	-
0.0.0.0	IPv4	-
1.12.10.1	IPv4	-
1.9.22.11	IPv4	-
1.9.201.2	IPv4	-
1.7.61.2	IPv4	-
1.12.1.31	IPv4	-
1.5.11.2	IPv4	-
1.5.31.2	IPv4	-
1.5.41.2	IPv4	-
1.5.61.2	IPv4	-
1.5.101.2	IPv4	-
1.5.111.2	IPv4	-
1.12.1.11	IPv4	-
1.12.1.21	IPv4	-
1.12.1.41	IPv4	-
1.12.1.51	IPv4	-
3.36.3.3	IPv4	-
5.29.212.5	IPv4	-
3.6.1.5	IPv4	-
1.3.14.3	IPv4	-
1.3.36.3	IPv4	-
2.5.29.19	IPv4	-
2.5.29.15	IPv4	-
2.5.29.14	IPv4	-
10.0.0.169	IPv4	-
0.0.0.1	IPv4	-
5.7.8.6	IPv4	-
2.1.7.1	IPv4	-

Showing 1 to 65 of 70 rows

Rows per page:

5.0 out of 5 · 4 most recent reviews

Text reviews

Positive

Negative

Bilişimde bunu bulan berat arkadaşım için teşekkür ediyorum

Eymen Kerem·19 Apr 2024

me gusta

Andrés Fernández Morales·11 Apr 2024

Bilişim dersinde vakit öldürmek için en iyisi aq. (ENG: Best for killing time in IT class)

mustafa·22 Dec 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Subway Surfers

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating