Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Volume Control

CRITICAL RISKRemoved from Chrome Web Store

Volume Control

ID: lhhgpflelfbhnihnbjigpgdbahgkbghp

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.6.0

Size

0.20 MB

Rating

4.4/5

Reviews

2,098

Users

196,883

Type

Extension

Updated

Aug 29, 2020

Publisher Contextual Analysis

Author: DevAudioView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

282,624

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Audio volume control for Chrome™. Set sound level for each tab separately with audio control and sound booster.

Individually control volume of each tab of your Chrome browser. Appreciate the convenience and benefits of an audio controller extension: - Increase volume up to 6 times (up to 600%); - Displays all tabs witch playing audio; - Fast navigation on tabs with sound; - Instantly mute tab (just click on the speaker icon in popup menu); - Displays the levels on the app icon in the toolbars menu; - Minimalistic design. For whom can be useful Volume Control app? If you are looking for a simple and convenient audio manager, with witch you can quickly and easily control the sound of each tab of your browser. If your speakers or headphones do not produce enough amount of sound for comfortable music listening or watching of video content - use the Volume control as a speaker booster by sliding the level control over 100%. That will give the opportunity to increase the sound volume up to six times.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium3

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6.0 Code review	10

Extension Version	Code Review Findings
1.6.0	10

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
core.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 140)	When config.done is set to true (controllable via the C2 server response stored in chrome.storage.local), the extension injects the raw string value of config.fixture as a script into any tab that triggers the 'getSet…	1.6.0
2	Data Exfiltration	critical	background.js (line 177)	After the extension has been activated 30 times, it silently contacts 'api.abiref.com' with the user's unique tracking ID (uid) and stores the entire JSON response body directly into chrome.storage.local without any v…	1.6.0
3	Phishing	critical	background.js (line 194)	After the C2 beacon call, if the server response included a 'link' field, the extension silently opens a new browser tab navigating to that server-controlled URL. This is used for forced ad injection, affiliate redire…	1.6.0
4	Remote Code Loading	critical	background.js (line 175)	The extension periodically contacts a remote server and writes the entire JSON response directly into extension storage with no schema validation or allowlist. Because other code paths consume storage fields like `fix…	1.6.0
5	Code Injection	high	manifest.json (line 15)	The content script player.js is injected into every HTTP and HTTPS page the user visits without exception. player.js sends a 'getSettings' message to the background page on every page load, which triggers the code inj…	1.6.0
6	Obfuscation	high	background.js (line 42)	The C2 server domains ('abiref.com' and 'api.abiref.com') are deliberately fragmented into single-character and multi-character string concatenations to defeat static analysis and keyword scanning. This is a classic o…	1.6.0
7	Phishing	high	background.js (line 190)	The extension opens a new tab to any URL stored in `data.link`, with no origin checks or user interaction. Because `link` is set from the remote JSON response, this gives the backend the ability to force arbitrary nav…	1.6.0
8	Tracking	medium	background.js (line 1)	On first install the extension immediately generates and persists a unique UUID (via core.getUserID) and records the installation timestamp (di) and extension version. This UUID is subsequently sent to the remote C2 s…	1.6.0
9	Tracking	medium	core.js (line 13)	The extension generates and persists a unique identifier in local storage, then later transmits that identifier to a remote analytics endpoint. This creates a durable cross-session tracking token without any visible u…	1.6.0
10	Unauthorized Data Collection	medium	core.js (line 13)	Generates and persistently stores a UUID v4 in the background page's localStorage under the key 'UID'. This UUID is transmitted to the remote server ('api.abiref.com') on every beacon call, providing a stable long-ter…	1.6.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
jquery.com	-	http://jquery.com/
sizzlejs.com	-	http://sizzlejs.com/

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Your extension is dope thanks

sovashadow·21 Sept 2020

タ��によって音量��えたりミ��ートにした��を頻繁に使うので、一度ミュートにした後ワンクリック��また同じ音量で再生出来れば良いのになぁ。複数のタブで操作��るのでfirefoxみた��どのタブがミュー��か一目でわかればもっと使いやすいなぁ。 MACでは正常に��えたけどWindowsでは一度ミュートにす��ともう音が出��です（泣）

Rie o·21 Sept 2020

タ��によって音量��えたりミ��ートにした��を頻繁に使うので、一度ミュートにした後ワンクリック��また同じ音量で再生出来れば良いのになぁ。複数のタブで操作��るのでfirefoxみた��どのタブがミュー��か一目でわかればも��と使いやすいなぁ。 MACでは正常に��えたけどWindowsでは一度ミュートにす��ともう音が出��です（泣）

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Volume Control

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews