Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Volume Controller

CRITICAL RISKRemoved from Chrome Web Store

Volume Controller

ID: cnlmgnlnpjaniibglhnppikopdcclfjp

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.6.9

Size

0.09 MB

Rating

4.3/5

Reviews

471

Users

112,643

Type

Extension

Updated

Dec 14, 2020

Publisher Contextual Analysis

Author: https://prodevone.infoView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

112,643

Control audio volume in your browser. Set individual volume level for tabs with audio. Get your audio rocking by our volume booster.

Volume Controller extension helps you to set a desired speaker volume level for each individual tab in your browser. Websites are just bursting with media content such as videos, music, streams, audio and video ads. To take control over all that audio you need a power volume adjust tool with the ability to set individual volume settings for each tab. To solve that task we developed our audio volume control extension. We made as simple and lite interface of our audio volume control switch as it just possible with keeping all of its power in a light design. A light and stylish window with a volume switch with a list of tabs that a currently playing audio content. You can separately change volume for each individual tab, so you will never get that sound mix that we all hate and control audio volume to your desire. It’s not just a volume switch, it works also as a volume booster. You can raise audio volume control switch to a 600% setting. This will just blast volume on those quiet videos! Try our volume app. You will love how simple and powerful it is. Use it on your favorite websites that are filled to the max with audio and video content, such as: Twitter™, Vimeo™, YouTube™, Facebook™, Spotify™ and others! Our sound volume control changer extension also remembers your previous settings for your convenience. Try it and you will love Volume Controller!

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking	Permission	Critical	This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
Dangerous Permission Combination	Risk Factor	Critical	This extension can intercept, modify, and block web requests in real-time.
tabCapture	Permission	High	This permission captures content and audio from browser tabs. Rated High because it can record sensitive web content, capture form input, and monitor user interactions.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
Older Manifest Version	Risk Factor	Medium	This extension uses Manifest Version 2
:///	Permission	Unknown	No classification available for this permission.

By severity

Critical4

High3

Medium1

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6.8 Code review	8

Extension Version	Code Review Findings
1.6.8	8

Files with findings

2 distinct paths — top paths by unique finding count:

background.js7
content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 328)	After each navigation sequence, the full redirect chain (every URL visited in that navigation) is serialized to JSON and POST-ed to a server-controlled log_rdr_endpoint. This exfiltrates the user's complete browsing h…	1.6.8
2	Network Interception	critical	background.js (line 65)	For every top-level navigation the user performs, the extension substitutes the visited URL/domain into a server-supplied affiliate URL template (aff_url_tmpl) and silently fires a background HTTP request. This is aff…	1.6.8
3	Privilege Escalation	critical	background.js (line 172)	When the C2 server sets filterCSP=true (applied at line 402), this function is invoked on every web response via the webRequestBlocking listener, stripping Content-Security-Policy, X-Frame-Options, and frame-options h…	1.6.8
4	Remote Code Loading	critical	background.js (line 384)	Every 15 minutes (900,000 ms) the extension POSTs extension ID, version, timestamp, and a persistent user UID to the operator's server, then applies whatever JSON config is returned — enabling or disabling traffic hij…	1.6.8
5	Network Interception	high	background.js (line 105)	The onBeforeSendHeaders listener replaces the Referer header on every HTTP/HTTPS request with a server-controlled value derived from a redirect chain. This spoofs referrer attribution so affiliate networks record the …	1.6.8
6	Other	high	background.js (line 196)	The extension probes for the presence of specific other extensions (IDs supplied by the C2 server as envCheckList) by silently creating hidden tabs and testing for CSS injection errors. When a watched extension — like…	1.6.8
7	Remote Code Loading	high	content.js (line 52)	The content script dynamically injects the Mixpanel analytics library from an external CDN into the DOM of every page the user visits when the C2 server enables extendedAnalytics. This is remote code loading into thir…	1.6.8
8	Tracking	medium	background.js (line 33)	A UUID is generated on first install and persisted permanently in both localStorage and chrome.storage.local. This UID is transmitted to the operator's C2 server on every beacon (every 15 minutes), creating a permanen…	1.6.8

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.w3.org	/2000/svg	http://www.w3.org/2000/svg

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Both my kid & I have been told by Bitdefender that this app has malware in it. Has anyone else received a similar message? I know that there have been apps on Google Play that have initially installed as safe, then during an update malware gets added to it & the app secretly does whatever the malware has programmed it to do. If this isn't true, can someone say why Bitdefender has flagged this as malware?

The Eternal Writer·19 Dec 2020

Chrome automatically disabled it for containing malware. Did some research and found that this extension contains adware. Scum.

Alexander Drake·18 Dec 2020

Version	Size	Is Malicious	Findings	Permhash
1.6.8 Latest	0.10 MB	Malicious	8	e5588103ff383980998a7a2e857a6a3639b3b1f64567dece6e51e8ed26625d35
1.6.7	0.14 MB	Malicious	—	0b4edd92378a1325ea221d2da95c8eaea3a3d50ea72bd7c6cee9eeeef8da33df
1.6.9	0.09 MB	Malicious	—	e5588103ff383980998a7a2e857a6a3639b3b1f64567dece6e51e8ed26625d35

Showing 1 to 3 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

Volume Controller

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Review Findings Summary Across 3 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews