Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: VolumeGain - Volume Booster

CRITICAL RISKRemoved from Chrome Web Store

VolumeGain - Volume Booster

ID: olenplikmfdcbehhnahdiefdfehapape

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.9.4

Size

0.37 MB

Rating

3.5/5

Reviews

Users

549,098

Type

Extension

Updated

Jun 13, 2021

Publisher Contextual Analysis

Author: Isabel CarreroView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

549,098

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Manage audio volume in tabs. Boost volume up to 600%

VolumeGain helps you manage audio volume. You can decrease and increase volume in a specific tab or globally. Volume Gain can increase the volume above the maximum. Features: * Boost volume up to 600% * Prevents software-related audio distortion * Save volume gain value for a specific tab, domain-wide or globally. How to use the extension: - You should reload a page with audio/video after you install the extension. - Click the extension icon in the browser popup and change the volume.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium3

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.9.4 Code review	3
1.9.3 Code review	5

Extension Version	Code Review Findings
1.9.4	3
1.9.3	5

Files with findings

2 distinct paths — top paths by unique finding count:

background.js7
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.js (line 1)	The background script dynamically loads and executes an external JavaScript file (analytics.js) from https://www.google-analytics.com at runtime. This constitutes remote code execution in a privileged extension contex…	1.9.3
2	Code Injection	high	background.js (line 232)	This code parses server-provided JSON and then uses reflective `bind` and `apply` calls on objects recovered from property paths. That is highly suspicious and obfuscated: it allows the remote response to steer what f…	1.9.4
3	Code Injection	high	background.js (line 1)	The background script calls `chrome.tabs.query({})` (no filter — all open tabs) and then dynamically executes injected code via `chrome.tabs.executeScript` across every matching tab in the browser. While the currently…	1.9.3
4	Remote Code Loading	high	background.js (line 189)	The extension defines a hard-coded remote configuration endpoint at `https://tryinternets.com/config/` and automatically fetches a host-specific JSON file. Pulling executable configuration from an external server is a…	1.9.4
5	Tracking	high	background.js (line 1)	The extension silently phones home to a Google Analytics property (UA-196932131-1) from its background script on every startup, transmitting the user's IP address, browser fingerprint, and extension activity telemetry…	1.9.3
6	Privilege Escalation	medium	manifest.json (line 1)	The manifest explicitly weakens the extension's Content Security Policy to allow scripts to be loaded from `https://www.google-analytics.com`, enabling the dynamic external script injection in background.js. A default…	1.9.3
7	Tracking	medium	background.js (line 28)	The background page loads Google Analytics from a remote domain and immediately emits telemetry. This is not inherently malicious, but it is a tracking mechanism inside a privileged extension context and is notable be…	1.9.4
8	Unauthorized Data Collection	medium	background.js (line 1)	The extension uses `chrome.tabCapture.capture` to obtain a full audio MediaStream from the active tab. While framed as volume boosting, the tabCapture API captures the complete rendered audio output of any tab (includ…	1.9.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
chrome.google.com	-	https://chrome.google.com
tryinternets.com	/config/	https://tryinternets.com/config/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.google-analytics.com;	-	https://www.google-analytics.com;
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
roundsliderui.com	/licence.html	http://roundsliderui.com/licence.html

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Niet installeren! Deze extensie installeert ongevraagd en hijackingtool waardoor je chrome-browser via charmsearching.com wordt omgeleid naar de (verschrikkelijke) BING-searchengine (waardoor ik er gelukkig achter kwam). Jammer dat Google dit soort malware in de store toelaat. Ook een teken aan de wand: het gros van de 4-sterren reviews zijn zo te zien gemaakt met nep-accounts.

Springin Theater·12 Aug 2021

A handy extension for my work.

lalaby happy·28 Jul 2021

its the best offer in my life!

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

VolumeGain - Volume Booster

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews