Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: WebSecurerr Browser Protection

CRITICAL RISKRemoved from Chrome Web Store

WebSecurerr Browser Protection

ID: odlnghcomkeenpeblhddfpacdncfjmna

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.1.2

Size

0.08 MB

Rating

3.7/5

Reviews

Users

207,734

Type

Extension

Updated

Sep 14, 2021

Publisher Contextual Analysis

Trusted

Author: http://searchsecurer.comView Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

207,734

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Protect your digital privacy and enjoy safe browsing experience

WebSecurerr protects you from visiting malicious sites and allows you to safely search the web. This Chrome extension blocks dangerous websites that distribute malware, spyware, viruses, trojans and prevents phishing attacks. WebSecurerr does not collect your browsing history or private data. It uses real-time security technology to protect your system from malware, scamware, spyware and adware. With WebSecurerr you can safely browse the web. For your safety dangerous websites are automatically blocked before they load. Websecurerr extension can be used with other antivirus, antimalware, antispyware and adblock products to enhance your online security and privacy. To support the features of this free extension, the browser's default search will be set to SearchSecurer.com. EULA https://www.searchsecurer.com/terms.html (c) 2020-2021 WebSecurerr: Anti-virus, anti-malware and anti-spyware site blocker, popup blocker & ad-blocker.

User Growth

Showing data from Jan 01, 2022 to Dec 25, 2022

Versions

+3.87%(+7,734 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 48 ratings

Average Rating

Current: 3.69 / 5.0+0.11

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High4

Medium3

Low1

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.1 Code review	5
1.0.9 Code review	7

Extension Version	Code Review Findings
1.1.1	5
1.0.9	7

Files with findings

6 distinct paths — top paths by unique finding count:

js/eventPage.js5
background.html2
manifest.json2
js/newtab.js1
js/warningPage.js1
warning.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/eventPage.js (line 135)	This code uses `webRequest`/`webRequestBlocking` to intercept top-level navigation requests and either close the tab outright or redirect the browser to an extension-controlled warning page. Because the intercepted UR…	1.1.1
2	Network Interception	critical	js/eventPage.js (line 1)	Using `webRequestBlocking` on `<all_urls>` for `main_frame` requests, the extension intercepts every top-level page navigation for URLs in the remotely-controlled blocklist and forcibly redirects the browser to the ex…	1.0.9
3	Remote Code Loading	critical	js/eventPage.js (line 1)	The extension fetches its URL blocklist from a remote server over plain HTTP (`http://searchsecurer.com/dbstart.json`), not HTTPS. This allows the list to be silently swapped via a MITM attack, giving any network adve…	1.0.9
4	Unauthorized Data Collection	critical	manifest.json (line 51)	The extension hijacks the browser's default search engine by replacing it with `searchsecurer.com`, routing all user searches through `https://go.searchsecurer.com/?a=gsp_stra_00_00&q=…`. The `a=gsp_stra_00_00` parame…	1.0.9
5	Network Interception	high	js/eventPage.js (line 70)	The extension periodically downloads URL lists from a remote server and immediately loads them into its local decision database. One of those feeds is fetched over plain HTTP, so a network attacker could tamper with t…	1.1.1
6	Remote Code Loading	high	background.html (line 11)	The background page includes a remote Google Analytics script. In an extension context, executing remotely hosted JavaScript is a serious risk because it gives external infrastructure code execution leverage inside a …	1.1.1
7	Tracking	high	background.html (line 10)	The persistent background page loads Google Analytics (`UA-164575602-1`) and Google Tag Manager directly into the extension's background context. Background pages in Chrome extensions have access to privileged extensi…	1.0.9
8	Tracking	high	js/eventPage.js (line 1)	On installation, the extension forcibly navigates the active tab to `https://searchsecurer.com/installed.html` — a common technique used by adware/browser hijackers to confirm successful installs for affiliate payment…	1.0.9
9	Other	medium	js/warningPage.js (line 1)	The warning page reads and writes an `allowedUrls` allowlist from `localStorage` that controls which hosts the background `webRequestBlocking` listener permits through without redirecting. This allowlist is serialized…	1.0.9
10	Tracking	medium	manifest.json (line 50)	The extension silently replaces the browser's default search provider with the vendor's own search endpoint. For a product framed as browser protection, changing all searches to a monetizable third-party engine is a s…	1.1.1
11	Unauthorized Data Collection	medium	js/newtab.js (line 80)	Every keystroke entered into the extension's search box is sent to `go.searchsecurer.com` for autocomplete suggestions. That creates a stream of user search-intent telemetry unrelated to core browser-protection functi…	1.1.1
12	Other	low	warning.html (line 21)	The hardcoded default placeholder URL in the warning page is `https://www.rkn.gov.ru/` — the official website of Roskomnadzor, Russia's federal internet censorship and surveillance agency. This is a highly unusual cho…	1.0.9

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
www.googletagmanager.com	/gtag/js	https://www.googletagmanager.com/gtag/js?id=UA-164575602-1
www.google-analytics.com	/analytics_debug.js	https://www.google-analytics.com/analytics_debug.js
ssl.google-analytics.com	/ga.js	https://ssl.google-analytics.com/ga.js
www.w3.org	/TR/html4/loose.dtd	http://www.w3.org/TR/html4/loose.dtd
searchsecurer.com	/dbstart.json	http://searchsecurer.com/dbstart.json

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

ta buena

Adrian Montoya·29 Aug 2022

I just saw this ad on a news website an I tried it, so far it's good and blocks dangerous links but I AM ANNOYED WITH THIS AD because it always show everywhere, thought it blocks malicious site but It doesn't block itself.

Jomar Balmores·4 Mar 2022

Loved it! its the best extension ever

Yash Raj Bhoi·7 Oct 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

WebSecurerr Browser Protection

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating