Unitab World Clock

ID: gcddlbhjbpfbphffmbckfhnggmcfkoni

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Removed
Version
1.0.0.4
Size
13.31 MB
Rating
3.0/5
Reviews
2
Users
20,000
Type
Extension
Updated
Feb 21, 2023
Category
Productivity Workflow
Price
Free
Featured
No
Visibility
Unlisted
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
UnitabView Profile
Country
IL
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Address
Tiomkin St 16 Tel Aviv-Yafo 6578317 IL
Total Extensions
3
Active
0
Obsolete
3
Listed
1
Unlisted
2
Total Users
60,044

Unitab World Clock - A new tab experience in your browser

The Unitab World Clock “new tab” page is a center of information. It includes various bits of information you can turn the different parts of its experience on and off. in Unitab World Clock you get full time and day for your location and other major locations' time zones, your favorite and most visited sites shortcuts, your bookmarks bar, popular services shortcuts for Gmail Inbox Feed / Outlook mail / Yahoo mail / Google Drive documents / Facebook / Amazon / Twitter and the user's defined shortcuts, a search box, a way to input what you’re focusing on today, links to the chrome extensions section and a to-do list as well as customize the background. In order to support the features of the extension, The extension will update your new-tab search provider to be powered by Top search engines. By clicking “Add to chrome”, I accept and agree to installing the Unitab World Clock's Chrome extension and setting Chrome™ New Tab to that provided by the service and the Terms of Use (https://Unitab.me/trms/) and Privacy Policy (http://Unitab.me/pp/). Powered by 50m.media LTD Technology - we are 100% FREE! Permissions used & reasons: "Replace the page you see when opening a new tab" This allows us to show you our new tab page with free web search and. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Read and change your bookmarks" - this allows to show the bookmarks in the extension user interface "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. "contextMenus"- The extension requires this permission in order to make the access to the Find now and web search as convenient as possible, through the extension “browser action” button. “Cookies” - The extension requires these permissions in order to allow payment for distribution affiliates. "Manage your downloads" / "Open downloaded files" - the extension offers quick access to the download folder. How do I uninstall the extension? On the top right of your screen, right click the Extension icon and choose "Remove from Chrome".

Item
Type
Severity
Description
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
topSites
Permission
High
This permission accesses the list of most visited websites. Rated High because it can reveal browsing patterns, identify frequently accessed service, and gather user behavior data.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
https://www.efeho.pw/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.bing.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://t.unitab.me/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://www.bing.com/*
downloads.open
Permission
Low
This permission opens downloaded files. Rated Low because it can only open files after explicit user download and selection.
bookmarks
Permission
Low
This permission manages browser bookmarks and folders. Rated Low because it can only modify bookmark data, which is not sensitive and changes are visible to users.

By severity

Critical2
High3
Medium3
Low1

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.0.0.39

Files with findings

3 distinct paths — top paths by unique finding count:

  • js/background.js6
  • js/thirdparty/notification-facebook.js2
  • js/installationAnalytics.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Credential Theft
critical
js/thirdparty/notification-facebook.js (line 63)Intercepts XHR request bodies to facebook.com and harvests internal Facebook session/CSRF parameters (__dyn, __a, fb_dtsg) so the extension can later replay authenticated requests as the user. fb_dtsg is a CSRF token …
2Data Exfiltration
critical
js/background.js (line 144)On install, the extension calls out to https://www.efeho.pw — a suspicious random-looking .pw domain — sending persistent device identifiers (dhid, mid) and the extension version. The .pw TLD plus the obscure 'pixlin'…
3Network Interception
high
js/thirdparty/notification-facebook.js (line 113)Embeds an authenticated Facebook iframe and postMessages stolen __dyn/__a/fb_dtsg tokens to it with target origin '*', attempting to read the user's private message threadlist. This is unauthorized access to a third-p…
4Remote Code Loading
high
js/installationAnalytics.js (line 2)Dynamically injects a remote script (ssl.google-analytics.com/ga.js) into the page via document.createElement('script'). Even though the destination is Google Analytics, this is remote code loading from outside the ex…
5Tracking
high
js/background.js (line 30)Uses the privileged 'cookies' permission to harvest 13 affiliate/tracking parameters (partner_id, click_id, mid, traffic_source, campaign, mkt_material, channel_name, server_address, channel_id, spid, sspid, dhid, sss…
6Obfuscation
medium
js/background.js (line 30)Combined with manifest host_permissions for https://www.efeho.pw/* and the cookies permission, the extension reads cookies from the operator's tracking domain and beacons identifiers to an unrelated random .pw domain.…
7Unauthorized Data Collection
medium
js/background.js (line 251)On uninstall the browser is forced to GET an HTTP URL containing the persistent device identifiers (mid, dhid), install date, and traffic_source. This both leaks installation/lifecycle telemetry tied to a unique devic…
8Unauthorized Data Collection
medium
js/background.js (line 174)Resolves the user's coarse geolocation via ipinfo.io without consent and persists country to sync storage. It then sends the lat/lon to nominatim.openstreetmap.org via updateGeoLoc to derive city/state/village. Collec…
9Unauthorized Data Collection
low
js/background.js (line 297)Fetches the user's public IP from cleartext http://jsonip.com (mixed-content / unauthenticated). While the function is currently unreferenced, leftover IP-harvesting plumbing is consistent with the broader fingerprint…
URLs
267
IPv4
2
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

www.reddit.com-http://www.reddit.com
www.instagram.com-http://www.instagram.com
www.tumblr.com-http://www.tumblr.com
m.facebook.com/messageshttps://m.facebook.com/messages
www.facebook.com-http://www.facebook.com
www.youtube.com-http://www.youtube.com
www.gmail.com-http://www.gmail.com
map.google.com-https://map.google.com
www.netflix.com-https://www.netflix.com
www.spotify.com-https://www.spotify.com
Showing 1 to 10 of 270 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

127.0.0.1
IPv4
-
1.0.0.4
IPv4
-
Showing 1 to 3 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.