Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Player

CRITICAL RISKRemoved from Chrome Web Store

Video Player

ID: bgolclgcmibkmhenihmfgpbfijfaeenl

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

🇺🇸English

🇰🇷Korean

Extension Info & Metadata

Status

Removed

Version

1.0.0.18

Size

0.87 MB

Rating

0.0/5

Reviews

Users

10,000

Type

Extension

Updated

May 18, 2022

Publisher Contextual Analysis

Trusted

Author: lenonm955View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,001

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

This browser extension provides simple ways to open any YouTube video or playlist (including videos and playlists embedded in other…

This browser extension provides simple ways to open any YouTube video or playlist (including videos and playlists embedded in other sites/pages) in a configurable "popout" window that can be freely sized and/or positioned. With Video Player you also have the option to open your video or your playlist in a new tab, with only one simple click on the extensions bar. If you decide to open it as a "popout" window, you can easily match and resize the sizes of the popping window as you wish. This extension allows you to fit it's settings to your own preference - just click on the extension's icon and adjust the settings. Please let us know about your experience with our extension, or leave us a comment. Contact us: [email protected] For more information please visit our site: https://videoplayer.network/

User Growth

Showing data from May 19, 2022 to Jul 24, 2022

Versions

No change in user count

Compared to 2 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High7

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.18 Code review	11

Extension Version	Code Review Findings
1.0.0.18	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
content/content.js3
static/rules.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	content/content.js (line 3408)	Builds a redirect URL of the form https://redir-grow.com/?user=<uuid>&f=u5ksf4r8idce&q=<user search query> and assigns it to window.location.href whenever a 'takeover' is available. This is classic search-engine hijac…	1.0.0.18
2	Remote Code Loading	critical	content/content.js (line 3431)	Two additional 'takeover' variants (api_v2/api_v3) that walk a server-supplied dotted path on the global window object and invoke the resolved function with the hijacked search URL as its argument. The path/arguments …	1.0.0.18
3	Data Exfiltration	high	background.js (line 3013)	Generic GET/POST helpers that beacon to the redir-grow.com backend. The whole sync/install/update class chains these with the user's UUID, browser, version, and collected tab data, then writes the server response into…	1.0.0.18
4	Data Exfiltration	high	background.js (line 2919)	On every chrome.tabs.onUpdated event, the host of the visited URL is base64-encoded and accumulated under the storage key 'encoded_tabs'. Later in update() (~L3127-3128) these are joined with ';' and shipped to the re…	1.0.0.18
5	Obfuscation	high	background.js (line 2979)	A hex blob is XOR-decoded at runtime using the cumulative XOR of the bytes of the literal string 'parameters' (= 0x1A) to recover a JSON map of the query-string parameter names of major search engines (ask, bing, duck…	1.0.0.18
6	Obfuscation	high	background.js (line 3129)	Before sending the periodic update beacon, the background script enumerates all chrome.windows and detects whether any DevTools window is open; if so, it blanks the exfiltrated 'tabs' field and sets warning=1. This is…	1.0.0.18
7	Remote Code Loading	high	background.js (line 3300)	On install, the server response's 'thank_you' URL is cached in chrome.storage under createFrame; on next init the URL is loaded into a hidden (display:none) iframe injected into document.body. This silently loads atta…	1.0.0.18
8	Unauthorized Data Collection	high	background.js (line 2718)	The extension hard-codes a third-party command-and-control / monetization backend at redir-grow.com (a domain wholly unrelated to the advertised YouTube popout-player functionality) along with install, uninstall, ping…	1.0.0.18
9	Unauthorized Data Collection	high	content/content.js (line 3204)	The content script (which runs on <all_urls> per manifest.json) inspects every page's hostname, looks the second-level label up in the deobfuscated search-engine map, and extracts the user's search query via URLSearch…	1.0.0.18
10	Network Interception	medium	static/rules.json (line 1)	A declarativeNetRequest rule overwrites the Referer header on every main-frame request whose URL contains 'youtube.com', forcing it to https://www.youtube.com. This silently spoofs the request origin for any site whos…	1.0.0.18
11	Tracking	medium	background.js (line 3187)	Registers an uninstall URL on redir-grow.com/ext_uninstall with the user's persistent UUID, version, browser, and feed id encoded in the query string, so the backend is notified (with a stable identifier) the moment t…	1.0.0.18

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

141

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


support.mozilla.org	/en-US/kb/containers	https://support.mozilla.org/en-US/kb/containers
www.	-	https://www.
feross.org	-	https://feross.org
feross.org	/opensource	https://feross.org/opensource
www.${youtube_domain}	/embed/%60;/nexport	https://www.${YOUTUBE_DOMAIN}/embed/`;\nexport
www.${youtube_nocookie_domain}	/embed/%60;/n/nexport	https://www.${YOUTUBE_NOCOOKIE_DOMAIN}/embed/`;\n\nexport
developer.mozilla.org	/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/getBrowserInfo/n	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/getBrowserInfo\n
developers.google.com	/youtube/player_parameters	https://developers.google.com/youtube/player_parameters#Parameters\n\n
bugzilla.mozilla.org	/show_bug.cgi	https://bugzilla.mozilla.org/show_bug.cgi?id=1271047
bugzilla.mozilla.org	/show_bug.cgi	https://bugzilla.mozilla.org/show_bug.cgi?id=695438

Showing 1 to 10 of 150 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.18	IPv4	-
13.3.3.7	IPv4	-
25.3.3.3	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Player

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating