IMAGE CLEANER CHROME EXTENSION UPDATE

IMAGE CLEANER CHROME EXTENSION UPDATE

Its entire ad blocking functionality essentially consists of 33 hardcoded rules and a tiny YouTube content script.īut wait, there is some functionality to update the rules! Except: why would someone put rule updates into a tabs.onUpdated listener? This is the code running whenever a tab finishes loading (simplified):

When opened it up, this turned out to be the most lazy ad blocker I’ve ever seen. There might be more, but I didn’t have time to thoroughly review more than a hundred browser extensions. The companies developing these extensionsĪltogether, I found malicious functionality in four browser extensions.The webRequest/declarativeNetRequest permission.The Great Suspender and Flash Video Downloader.If you aren’t interested in the technical details, you should probably go straight to the list of affected extensions. All of these extensions are clearly meant for dubious monetization. The names are often confusingly similar to established products. While most of these extensions didn’t seem to contain malicious code (yet?), almost all of them requested excessive privileges under false pretenses. I kept finding similar extensions until I had a list of 109 extensions, installed by more than 62 million users in total. In reality, it turned out to be an obfuscated malicious logic meant to perform affiliate fraud. Supposedly, it was buggy locale processing. When I looked into this extension, I immediately discovered a strange code block.

That, and the permissions: why does a translator extension need webRequest and webRequestBlocking permissions?

When looking for more PCVARK extensions, I stumbled upon an inconspicuous extension called “Translator - Select to Translate.” The only unusual thing about it were its reviews, lots of raving positive reviews mixed with usability complains. We’ve also seen PCVARK’s malicious ad blockers. We’ve already seen Chrome extensions containing obfuscated malicious code.

Image cleaner chrome extension