Security Alert: Confirmed Malware
V·Comm
ID: kinnehdjfdcilmhhfopnpmjiabkiigje
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Country
- ES
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- Polígono Industrial El Laurel Calle Víctor Jara 103-104 La Zubia, Granada 18140 ES
Email Change History
Trabajo con documentos digitales en V·Comm
Extensión de la Plataforma de Administración Electrónica V·Comm. Permite la firma electrónica de documentos dentro del ecosistema de aplicaciones V·Comm.
The `externally_connectable` manifest key is set to match all URLs (`*://*/*`), which allows any webpage on the internet to directly invoke `chrome.runtime.sendMessage` targeting this extension. Combined with the `nativeMessaging` permission and the background message handler that launches native executables, any website can trigger arbitrary local program execution on the user's machine without any user confirmation.
{ "externally_connectable": { "matches": [ "*://*/*" ] }, "content_scripts": [ { "js": [ "data/content/content.js" ], "matches": [ "<all_urls>" ] } ]}The `launchApp`, `launchAppScanner`, and `launchAppPrinter` functions build native-app command-line parameter strings by direct string concatenation of values sourced from web page DOM elements (`element.idProceso`, `element.uriUpSig`, `element.docs`, etc.) with no sanitization or escaping. A malicious webpage can inject arbitrary arguments into the native process by embedding command-separator characters or flag overrides, enabling parameter injection into the signed-document or scanner executable.
launchApp: function(element) { ... case 1: var _app = VExec.app_path + "\\" + VExec.app_exe; var _param = '--idProceso="' + element.idProceso + '" --uriUpSig="' + element.uriUpSig + '" --imgFirma="' + element.imgFirma + '" --docs="' + element.docs + '" --uriDown="' + element.uriDown + '" --uriUp="' + element.uriUp + '" --version="1"'; var message = { app: _app, param: _param }; VExec.port.postMessage(message, function(res) {The `chrome.runtime.onMessage` handler in the service worker unconditionally trusts the `action` field of incoming messages to trigger `connectNative()` and launch executables, without verifying that the message originates from a trusted internal extension page. Because `externally_connectable` allows all origins, external web pages can directly send `open-sign-app`, `open-scanner-app`, or `open-printer-app` messages to this handler and invoke the native host.
chrome.runtime.onMessage.addListener(function(request, sender, sendResponse) { switch (request.action) { case "init-app": VBackgroundFirma.addElements(request.element); VExec.lastTab = null; break; case "open-sign-app": VLogAdd("Orden para abrir la aplicación de firma"); VExec.lastTab = parseInt(sender.tab.id); VBackgroundFirma.openApp(request.id); break; case "open-scanner-app": VLogAdd("Orden para abrir la aplicación de escaner"); VExec.lastTab = parseInt(sender.tab.id); VBackgroundFirma.openAppScanner(request.id); break; case "open-printer-app": VLogAdd("Orden para abrir la aplicación de impresora"); VExec.lastTab = parseInt(sender.tab.id); VBackgroundFirma.launchAppPrinter(request.id); break;The content script, injected into every page (`<all_urls>`), listens for custom DOM events (`vcomm-add-object`, `vcomm-launch-object`, `vcomm-scan-objects`) dispatched by the hosting page. Any website can fire these events with attacker-controlled payloads to register arbitrary signing elements and then trigger native application launches—providing a DOM-level attack surface that bypasses any external-messaging controls.
// Evento que buscar los nuevos objetos de firmadocument.addEventListener('vcomm-add-object', function(e) { if (!Array.isArray(VFirmaPrototype.elements)) { VFirmaPrototype.elements = new Array(); } VFirmaPrototype.elements.push([e.detail]); chrome.runtime.sendMessage({ from: 'content', action: 'init-app', element: [e.detail] });}, true);// Evento que buscar los nuevos objetos de firmadocument.addEventListener('vcomm-launch-object', function(e) { if (typeof e.detail !== "object") { console.warn("Event require 'type (vsign, vscanner, vprinter) and id' (01)"); } switch (e.detail.type) { case "vsign": chrome.runtime.sendMessage({ from: 'content', action: 'open-sign-app', id: e.detail.id }); break;The extension's options page contains a hardcoded download link to an external Windows executable (`VSign.exe`) hosted on `update.vcomm.es`. This promotes installation of an unverified native binary from an external server directly from within the extension UI; if the host is compromised or the extension is cloned maliciously, users could be directed to download malware.
<a href="https://update.vcomm.es/appupdates/vsign/VSign.exe" target="_Blank" style="font-size: 1.2em"> Descargar aplicación nativa < /a>All extension activity logs—including app paths, executable names, document signing URIs, and scan parameters—are written to `chrome.storage.sync`, which synchronises data across all of the user's Chrome browser instances. Sensitive operational details (document upload URIs, process IDs, file paths) are thus exfiltrated to Google's sync infrastructure and may be accessible from other devices or by extensions with `storage` read access.
function VLogAdd(msg) { VLog.push(new Date() + ": " + msg); chrome.storage.sync.set({ log: VLog });}By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.0 | 6 |
Files with findings
4 distinct paths — top paths by unique finding count:
- service-worker.js3
- data/config/config.html1
- data/content/content.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.