Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Vex 6

CRITICAL RISKRemoved from Chrome Web Store

Vex 6

ID: eebmcfokiimcgpoldlojdepgfiiamehe

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.6.4

Size

15.14 MB

Rating

3.7/5

Reviews

Users

10,000

Type

Extension

Updated

Apr 12, 2024

Publisher Contextual Analysis

Trusted

Author: vex games unblockedView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

13,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Vex 6 game extension for chrome. Play Vex 6 unblocked game online for free.

Vex 6 Unblocked Game is the sixth platform game in the Vex series. There are several new features and challenges in Vex 6. As usual, navigate through a series of tricky traps and obstacles to make it to the end of each level! Like the previous Vex games, you’re going to be repeatedly slashed, splatted, and decapitated by various deadly contraptions. The only way to get better and minimize deaths is to keep playing until you have mastered the technique and know the timings perfectly. Vex 6 Unblocked Game Features: * Survive tricky traps and obstacles * Unlock new skins for your character Controls * AD or left/right arrow to move * W or up arrow to jump * S or down arrow to crouch (enter an act)

User Growth

Showing data from Sep 13, 2023 to Apr 24, 2024

Versions

+521.89%(+8,392 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 3 ratings+1 (50%)

Average Rating

Current: 3.67 / 5.0+3.67

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium2

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6.3 Code review	7

Extension Version	Code Review Findings
1.6.3	7

Files with findings

5 distinct paths — top paths by unique finding count:

manifest.json2
storage.js2
@gamedistribution/game.json1
js/content.js1
service_worker.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	storage.js (line 7)	The sandboxed game context intercepts all cookie set operations and localStorage writes, then exfiltrates them to the parent frame via postMessage with a wildcard origin (`"*"`). Any cookie longer than 100 characters …	1.6.3
2	Unauthorized Data Collection	critical	storage.js (line 56)	The parent page receives cookies and localStorage data from the sandboxed iframe via postMessage and persists them into `chrome.storage.local`. The wildcard `"*"` on outbound postMessage calls means any origin can rec…	1.6.3
3	Tracking	high	js/content.js (line 1)	This content script runs on every HTTPS page at `document_start` and looks for a hidden input element with id `installed-vex-6`. If found, it injects the user's OS platform (collected by the service worker) into the e…	1.6.3
4	Tracking	high	@gamedistribution/game.json (line 70)	The bundled game configuration references a domain named `spy.games235.com` as the `dmn` (domain) field. The word "spy" in the domain name is a strong indicator of surveillance intent, and this domain does not corresp…	1.6.3
5	Unauthorized Data Collection	high	service_worker.js (line 14)	The service worker continuously collects the user's operating system via `getPlatformInfo` and stores it in `chrome.storage.local`, refreshing every 30 minutes via a persistent alarm. A game extension has no legitimat…	1.6.3
6	Code Injection	medium	manifest.json (line 13)	The sandbox CSP allows `unsafe-eval` and `unsafe-inline` across all script contexts including object-src, child-src, worker-src, and script-src-elem. This maximally permissive policy enables dynamic code evaluation (`…	1.6.3
7	Tracking	medium	manifest.json (line 16)	The content script is injected into every HTTPS page the user visits at `document_start`, before any page scripts execute. While the individual content.js is short, this broad injection combined with `document_start` …	1.6.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.iab.net	/videosuite/vmap	http://www.iab.net/videosuite/vmap
html5.api.gamedistribution.com	/blocked.html	https://html5.api.gamedistribution.com/blocked.html?
play.google.com	-	https://play.google.com
itunes.apple.com	-	https://itunes.apple.com
gamedistribution.com	-	https://gamedistribution.com
gamedistribution.com	-	https://gamedistribution.com/
img.gamedistribution.com	-	https://img.gamedistribution.com/
www.fontsquirrel.com	-	https://www.fontsquirrel.com
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


16.5.0.100	IPv4	-

5.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

great game

jayden nwamadi·21 Apr 2024

This is a great game, do not pay attention to the rating.

JUAN PABLO LOPEZ MORENO·10 Apr 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Vex 6

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating