Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Voice Search

CRITICAL RISKRemoved from Chrome Web Store

Voice Search

ID: maopdcnkgkmbjlaekjfofmocdbclpnkh

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.0.1

Size

0.05 MB

Rating

1.0/5

Reviews

Users

20,000

Type

Extension

Updated

May 15, 2024

Publisher Contextual Analysis

Author: https://searchvoiceapp.netView Profile
Privacy: Privacy Policy
Help: Help Center
Country: IL
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: 5 Yehonatan Netanyahu Or Yehuda 6037603 IL
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

20,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Default search extension that supports voice search from the address bar

This is a default search extension that enables users to use voice search directly from their address bar. Once the user types a query in the address bar, quick access to activate voice search will be provided to the user while they are typing. Learn more: https://www.searchvoiceapp.net/

User Growth

Showing data from Apr 20, 2024 to Jan 29, 2025

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 1.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium3

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.0 Code review	8

Extension Version	Code Review Findings
3.0.0	8

Files with findings

4 distinct paths — top paths by unique finding count:

bg/background.js4
manifest.json2
content_script/install.js1
utils/helpers.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	high	manifest.json (line 37)	Grants the remote searchvoice.net property a privileged channel to message the extension service worker (`onMessageExternal`) and injects a content script that brands the DOM (`document.body.className += ' vopr'`) so …	3.0.0
2	Privilege Escalation	high	bg/background.js (line 23)	Allows pages on searchvoice.net to send arbitrary messages to the privileged service worker. The handler invokes `clstCheck()` which enumerates and force-closes all popup-type browser windows (`chrome.tabs.remove`) at…	3.0.0
3	Privilege Escalation	high	bg/background.js (line 146)	Remotely-triggered routine (callable from searchvoice.net via onMessageExternal) that enumerates every popup-type tab in the browser and unconditionally closes them. This abuses the cookies/<all_urls> capabilities to …	3.0.0
4	Tracking	high	manifest.json (line 7)	The extension forcibly hijacks the user's default search engine, redirecting all omnibox queries (including search suggestions/typeahead) through searchvoice.net with affiliate-style tracking parameters (s=vopr, vert=…	3.0.0
5	Tracking	high	bg/background.js (line 118)	Uses the privileged `cookies` API to write cross-site cookies (`SameSite=None`, secure) on searchvoice.net carrying the user's chosen search engine and a `use_ac` flag. This is unnecessary for an extension's own state…	3.0.0
6	Tracking	medium	content_script/install.js (line 1)	Injects a marker class onto the body of any searchvoice.net page so the operator's web pages can detect the presence of the extension and uniquely correlate visiting users with installed users. This is a classic brows…	3.0.0
7	Tracking	medium	bg/background.js (line 10)	On install, sets an uninstall redirect URL pointing at searchvoice.net carrying source/affiliate parameters (s=vopr, vert=private) to track post-uninstall traffic for monetization/attribution. Combined with the cookie…	3.0.0
8	Unauthorized Data Collection	medium	utils/helpers.js (line 18)	Helper that lets any other module of the extension persist arbitrary key/value data into cookies on the operator's apex domain (`.searchvoice.net`) with `SameSite=None`. Combined with `getCookie`, the popup uses the o…	3.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.searchvoice.net	/favicon.ico	https://www.searchvoice.net/favicon.ico
www.searchvoice.net	/search/	https://www.searchvoice.net/search/?category=web&s=vopr&vert=private&q={searchTerms}
sug.searchvoice.net	/v1/sug/	https://sug.searchvoice.net/v1/sug/?yid=vopr&vert=private&q={searchTerms}
www.searchvoice.net	/wim/gotohub	https://www.searchvoice.net/wim/gotohub?s=vopr
*.searchvoice.net	/*	https://.searchvoice.net/
fonts.googleapis.com	-	https://fonts.googleapis.com
fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Manrope:wght@400&display=swap

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

I have a free standing mail box in front of my house. When I have outgoing mail, I lift the flag. I send several cards each week using snail mail. I spen a great deal on postage. placed two cards in my mail box on Monday, The mail comes very late, sometimes after8 PM. The letteres were left, pushed to the back. This happened Wednesday, and Thursday. I went out of town on Thursday, I returned on Sunday, The cards were stil there. I sent a card to NY the week before. The address was correct, the name was spelled correct, the person has live at that address for many ywears (30 years). The card was returned due to the wrong apartment #. I had to pay an additional $.66 to remail the card. What happened to real mail handlers. I think I will switch to email cards.

Sandra Brandt·21 Nov 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Voice Search

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating