Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Skipping Ads

CRITICAL RISKRemoved from Chrome Web Store

Video Skipping Ads

ID: gkkahcppchjlidcjmobmmpknfaebllii

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.83

Size

0.13 MB

Rating

0.0/5

Reviews

Users

6,000

Type

Extension

Updated

Apr 19, 2022

Publisher Contextual Analysis

Author: bennettjared48View Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Video Skipping Ads is an add-on that skips or blocks video ads. If you are tired to click on the skip button or closing boring ads…

Video Skipping Ads is an add-on that skips or blocks video ads. If you are tired to click on the skip button or closing boring ads over your video, this extension is for you. A simple ad skipper that automate the task of to click on skip ad button. Who likes Interruption? No one. Unwanted noise of ads which seek our attention & action can be dealt magically by the simple tool. Removing or blocking ads is possible now with this app for video streaming platforms. Automatically skip a commercial while playing videos & many more things with Video Skipping Ads for video stream. The app simply gives an answer of how to block ads. ~~ Contact Us ~~ Email : [email protected] Find out more here: https://videoskippingads.network/#terms-of-use ~~ ♥ Keep in touch! ~~ Visit site to learn more and get our latest updates and news: → https://videoskippingads.network/

User Growth

Showing data from Apr 15, 2022 to May 11, 2022

Versions

No change in user count

Compared to 26 days ago

2 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High2

Medium0

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.82 Code review	6

Extension Version	Code Review Findings
1.0.0.82	6

Files with findings

2 distinct paths — top paths by unique finding count:

background.js4
content/content.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 1300)	The update function assembles collected browsing hostnames (joined with ';') into a GET request sent to https://windowssrch.com/data along with browser type, extension version, user UUID, and feed ID. After sending, t…	1.0.0.82
2	Data Exfiltration	critical	content/content.js (line 1233)	The content script implements a 'search takeover' mechanism that intercepts user search queries (monitoring URL parameters 'q', 'p', 'text' across all URLs due to the <all_urls> manifest match). When triggered, it red…	1.0.0.82
3	Tracking	critical	background.js (line 1480)	The extension's hardcoded configuration reveals a full affiliate/adware C2 infrastructure on windowssrch.com — a domain unrelated to YouTube ad-skipping. It tracks install (/ext_install), uninstall (/ext_uninstall), d…	1.0.0.82
4	Unauthorized Data Collection	critical	background.js (line 1419)	The background service worker hooks chrome.tabs.onUpdated and silently records the hostname of every URL the user navigates to, base64-encoding and storing up to 5 recent hosts under the key 'encoded_tabs'. These coll…	1.0.0.82
5	Obfuscation	high	background.js (line 1307)	Before sending the collected browsing data to the C2 server, the extension checks all open windows for DevTools instances. If DevTools is detected, it sets a 'warning=1' flag and clears the tab browsing data from the …	1.0.0.82
6	Tracking	high	content/content.js (line 1053)	The content script runs at document_start on all URLs (manifest: <all_urls>, all_frames: true) and on every page load extracts the host from window.location.href and records it, plus monitors for search query paramete…	1.0.0.82

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


feross.org	-	https://feross.org
feross.org	/opensource	https://feross.org/opensource
bugzilla.mozilla.org	/show_bug.cgi	https://bugzilla.mozilla.org/show_bug.cgi?id=695438
github.com	/feross/buffer/pull/148/nObject.setPrototypeOf(Buffer.prototype,	https://github.com/feross/buffer/pull/148\nObject.setPrototypeOf(Buffer.prototype,
github.com	/feross/buffer/issues/154/nBuffer.prototype._isBuffer	https://github.com/feross/buffer/issues/154\nBuffer.prototype._isBuffer
stackoverflow.com	/a/22747272/680742,	http://stackoverflow.com/a/22747272/680742,
github.com	/feross/buffer/issues/166/nfunction	https://github.com/feross/buffer/issues/166\nfunction
github.com	/feross/buffer/issues/219/nvar	https://github.com/feross/buffer/issues/219\nvar
en.wikipedia.org	/wiki/Base64	https://en.wikipedia.org/wiki/Base64#URL_applications\nrevLookup[
github.com	/beatgammit/base64-js/issues/42/n	https://github.com/beatgammit/base64-js/issues/42\n

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.83	IPv4	-
13.3.3.7	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Skipping Ads

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating