Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Viber

CRITICAL RISKRemoved from Chrome Web Store

Viber

ID: dafalpmmoljglecaoelijmbkhpdoobmm

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.2.0

Size

6.25 MB

Rating

3.4/5

Reviews

1,985

Users

159,036

Type

Extension

Updated

Jul 9, 2017

Publisher Contextual Analysis

Author: http://www.viber.comView Profile

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

159,036

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Viber's share button allows 'Viber Desktop' users to easily share web sites, Photos and Text directly from the browser

With the Viber Chrome Extension you can share the best of the web easily with anyone on Viber. Links, text and photos can be sent via the Viber Desktop App in just one click. When you find something you like, this handy tool makes it easy to share with your contacts: - click on the Viber icon in your toolbar to share a link - hover on an image to see the share icon - highlight text and then right click to share a quote - preview your content before you share it To share content through the Viber chrome extension you need to make sure the latest version of Viber is up and running on your desktop. Visit www.viber.com/dl to download Viber Desktop for FREE.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium5

Low3

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.0 Code review	12

Extension Version	Code Review Findings
1.2.0	12

Files with findings

3 distinct paths — top paths by unique finding count:

scripts/background.js8
scripts/app.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	high	scripts/background.js (line 4472)	The embedded socket_client module opens a WebSocket connection to `ws://localhost` cycling through ports 45112, 38567, and 25613. This localhost WebSocket channel is used to relay page URLs, titles, images (base64-enc…	1.2.0
2	Data Exfiltration	high	scripts/background.js (line 4423)	The `sendImage` function in `client_bridge.js` (embedded in background.js) renders remote images in a Canvas element to produce a base64 data URL, then transmits the encoded image payload over the localhost WebSocket …	1.2.0
3	Unauthorized Data Collection	high	scripts/background.js (line 4183)	The background script's message listener calls `chrome.management.getAll()` in response to any content script sending a 'get-apps' action. This enumerates every installed Chrome extension and app on the user's browser…	1.2.0
4	Unauthorized Data Collection	high	scripts/app.js (line 4636)	The `page_helper` module's internal `a()` function fetches arbitrary URLs via jQuery AJAX and writes the raw HTML response into a freshly created document using `document.write()`. This is invoked by `retrievePageInfo…	1.2.0
5	Other	medium	scripts/background.js (line 4472)	The extension automatically probes multiple localhost ports and opens a WebSocket to a local Viber service, then sends JSON messages over that channel. Localhost bridges are sometimes legitimate companion-app integrat…	1.2.0
6	Tracking	medium	scripts/background.js (line 4247)	An analytics module hardcodes a Mixpanel account token (`20625b657c285d3d41d21bd3d4b50f1c`) and beacons user interaction events including the browser version string to `api.mixpanel.com` on a 10% sampling rate. The ev…	1.2.0
7	Tracking	medium	scripts/background.js (line 4188)	Using `chrome.management.getAll(...)` lets the extension enumerate the user's installed apps and extensions. Here it is exposed to the content side through the `get-apps` message path, which creates a device-fingerpri…	1.2.0
8	Unauthorized Data Collection	medium	scripts/app.js (line 4687)	The content-script-side `utils.js` module exposes `isAppInstalled()`, which calls `getInstalledApps()` through the background bridge (triggering `chrome.management.getAll()`). This is used in app.js to check whether e…	1.2.0
9	Unauthorized Data Collection	medium	scripts/app.js (line 4416)	This content script runs on all HTTP and HTTPS pages and captures user-selected text, merges it with page metadata, and forwards it via `s.sendData(...)`. The behavior matches the extension's sharing feature, but from…	1.2.0
10	Other	low	manifest.json (line 32)	The manifest exposes the entire `scripts/` directory as web-accessible resources, meaning any webpage can load or probe the extension's bundled JavaScript files via `chrome-extension://` URLs. This allows malicious th…	1.2.0
11	Tracking	low	scripts/background.js (line 4254)	The extension transmits usage telemetry to Mixpanel, including extension event names and the browser version, over a remote analytics endpoint. This is standard tracking rather than overt malware, but it is still exte…	1.2.0
12	Unauthorized Data Collection	low	scripts/background.js (line 4196)	The extension registers page, selection, image, and link context-menu handlers on all sites and forwards those clicks into its content script, giving it access to selected text and clicked resources. This is not inher…	1.2.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.ascendercorp.com	/typedesigners.htmlLicensed	http://www.ascendercorp.com/typedesigners.htmlLicensed
ocsp.verisign.com0	-	http://ocsp.verisign.com0
crl.verisign.com	/tss-ca.crl0U%%EF%BF%BD	http://crl.verisign.com/tss-ca.crl0U%�
http:	-	http://ocsp.verisign.com0U�0�0AU:0806�4�2�0http://crl.verisign.com/ThawteTimestampingCA.crl0U%
www.verisign.com	/rpa	https://www.verisign.com/rpa
www.verisign.com	/cps0*+0https://www.verisign.com/rpa0U%EF%BF%BD0m+	https://www.verisign.com/cps0*+0https://www.verisign.com/rpa0U�0m+
logo.verisign.com	/vslogo.gif0U%0++04+(0&0$+0%EF%BF%BDhttp://ocsp.verisign.com01U*0(0&%EF%BF%BD$%EF%BF%BD	http://logo.verisign.com/vslogo.gif0U%0++04+(0&0$+0�http://ocsp.verisign.com01U*0(0&�$�
crl.verisign.com	/pca3.crl0	http://crl.verisign.com/pca3.crl0
www.verisign.com	/rpa0U%	https://www.verisign.com/rpa0U%
ocsp.verisign.com0	-	http://ocsp.verisign.com0?+0�3http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0U#0��k�&pȡ?�-�5��0

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

not good at all does not even let me click it not worth this is going to just going to waste your time.

Nina·23 Dec 2020

coool

aya ayouta·11 Dec 2020

��ма не пользуюсь,но �� друзей есть такое п��иложение.Они не жалую��ся.

МЛ

мария лямкина·12 Nov 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Viber

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews