Security Warning: High Security Risk
Wordy Pop - Form words quickly before the board fills up!
ID: mloahanodnoamakomklblhjmnpjpjclo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- daimaschueri5View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Wordy Pop: A relaxing offline word game that challenges your vocabulary skills. Create words and score high!
Wordy Pop: The Ultimate Word Game for Chrome Wordy Pop is a captivating and relaxing word game that has now been transformed into a offline-capable Chrome extension, ensuring you can enjoy it anywhere, anytime. This engaging game is perfect for fans of word puzzles, crosswords, and vocabulary building. How to Play In Wordy Pop, your mission is to create as many valid words as possible from a board filled with falling letter blocks. Simply select the letters by clicking on them with your left mouse button. The goal is to form words before the letters flood the screen, making it a challenging yet fun experience. Key Features - Endless Word Creation: Form as many words as you can to achieve the highest score. - Strategic Use of Bombs: Utilize bombs to remove entire rows of letters, helping you clear the board and prolong your gameplay. - Simple yet Engaging: Easy to learn, but challenging to master, making it a great fit for word game enthusiasts. - Offline Capability: Enjoy the game without an internet connection, making it perfect for commutes or any time you're offline. - Free to Play: Download and play Wordy Pop completely free, with no hidden costs or subscriptions. Why You'll Love It Wordy Pop combines the thrill of word puzzles with a relaxing gameplay experience. It's an excellent way to sharpen your vocabulary, improve your spelling skills, and have fun while doing so. The game's innovative mechanics and endless levels ensure that you'll never run out of new challenges. Download Wordy Pop now and start creating words to beat your high score 📚✨ We provide a "Play More Games" button in the extension and open our official website when you first install it, where you can experience more free games.
This extension requests no permissions and has no recorded risk factors.
The extension fetches arbitrary URLs from a third-party API (`game-extension-api.offlinegames.fun`) and injects them as iframes via unsanitized `innerHTML` into the extension's own UI page. The destination domain is not the publisher's disclosed domain, is not a well-known SaaS, and is not declared in the CWS privacy disclosures. This pattern — a remotely-controlled iframe allow-list — is a classic mechanism for serving ad content or later pivoting to malicious payloads without a CWS code update. The `data.enable` gate gives the server-side full control over whether the iframes are shown, and the iframe URLs are completely server-controlled.
async function setRecommendGames() { await sleep(10); const installTime = parseInt(localStorage.getItem('installTime')); if (installTime && Date.now() - installTime < 1000 * 60 * 60 * 24 * 1) { return; } try { const response = await fetch('https://game-extension-api.offlinegames.fun/recommend/'); const data = await response.json(); if (!data.enable) { return; } const recommendBox1 = document.querySelector('.recommend-box-1'); const recommendBox2 = document.querySelector('.recommend-box-2'); if (data['recommend-1']) { recommendBox1.innerHTML = `<iframe src="${data['recommend-1']}" width="100%" height="100%"></iframe>`; recommendBox1.style.display = 'block'; } if (data['recommend-2']) { recommendBox2.innerHTML = `<iframe src="${data['recommend-2']}" width="100%" height="100%"></iframe>`; recommendBox2.style.display = 'block'; } } catch (err) { }}The primary game iframe is granted an extremely broad `allow` policy including `camera`, `microphone`, `payment`, `clipboard-read`, `clipboard-write`, and `display-capture`. While these permissions may be inherited from a game SDK template, they are disproportionate for a word game and amplify risk given the remote iframe injection finding above — any iframe injected via `setRecommendGames()` could leverage the page context. The game itself loads from a remotely-controlled `iframeSrc` (from the missing `info.mjs`), so the effective surface for these permissions is server-determined content.
<iframe class="game-iframe" id="gameFrame" src="" allow="autoplay;camera;payment;gamepad;keyboard-map *;xr-spatial-tracking;clipboard-write;web-share;magnetometer;gyroscope;display-capture;fullscreen;microphone;screen-wake-lock;clipboard-read;accelerometer;" frameborder="0">By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.5 | 2 |
Files with findings
2 distinct paths — top paths by unique finding count:
- game.html1
- js/game.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.