Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: XToys

CRITICAL RISKRemoved from Chrome Web Store

XToys

ID: hhddbheipffnedlmnefnkjeplkgbajij

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.6

Size

0.05 MB

Rating

5.0/5

Reviews

Users

8,000

Type

Extension

Updated

Oct 9, 2025

Publisher Contextual Analysis

Trusted

Author: https://xtoys.appView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

8,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Triggers events in XToys.app based on activity on an external webpage or connect to the XToys desktop utilities.

Used for controlling sex toys based on activity happening in other browser tabs. Connects to scripts running at https://xtoys.app.

User Growth

Showing data from Aug 19, 2025 to Aug 02, 2026

Versions

+25%(+2,000 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 3 ratings

Average Rating

Current: 5.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High1

Medium5

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.6 Code review	6

Extension Version	Code Review Findings
3.6	6

Files with findings

3 distinct paths — top paths by unique finding count:

content.js3
background.js2
var_check.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	high	var_check.js (line 1)	The web-accessible script var_check.js polls arbitrary global window variables (name supplied via query string from the bridged xtoys.app commands) every 200ms and exfiltrates their JSON-serialized values via window.p…	3.6
2	Code Injection	medium	background.js (line 350)	On toolbar action click, the extension uses chrome.scripting.executeScript to inject jQuery and content.js into ALL frames of the active tab regardless of origin. Once injected, the content script opens a runtime port…	3.6
3	Data Exfiltration	medium	content.js (line 6)	The content script listens for any window 'message' event with no origin check or source validation and forwards the payload to the extension background, which relays it to xtoys.app. Any script on the page (including…	3.6
4	Privilege Escalation	medium	background.js (line 443)	The background script exposes 13 native messaging host bridges (keyboardcontrol, keyboardmonitor, mousemonitor, screenmonitor, soundlevelmonitor, filemonitor, bluetoothhelper, localwebhook, etc.) that can be triggered…	3.6
5	Unauthorized Data Collection	medium	content.js (line 80)	The content script accepts a 'sendText' command from the bridged xtoys.app origin and programmatically populates a jQuery-selected input field, then dispatches synthetic Enter key events to submit chat dialogs on the …	3.6
6	Unauthorized Data Collection	medium	content.js (line 195)	MutationObserver continually scans the DOM with arbitrary jQuery selectors and regex patterns supplied by the xtoys.app bridge, capturing matched text content and capture groups, then exfiltrating them via the runtime…	3.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
localhost	/*	https://localhost:8080/*

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

This does exactly what it is supposed to, and if you know what that is you'll understand why it has 5 stars

David Smith·10 Oct 2023

Lovely tool ;)

Spykee Volt·15 Nov 2022

This tool has been a necessity for me

Lily Larceny·29 Oct 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

XToys

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating