[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

Mobile Guardian

Version 2.2.68 View in Chrome Web Store

Last scanned: about 2 months ago | force re-scan

Extension Details

Rating: 1.0 ★ (15 ratings)

Users: 410

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has extremely poor trust indicators with only 410 users, a devastating 1.0-star rating from 15 reviews, and no identifiable developer information. The name "Mobile Guardian" suggests device management functionality, but the lack of transparency about the developer raises serious red flags. The low user adoption combined with terrible reviews indicates significant user dissatisfaction or potential malicious behavior.

Concerns:

This extension exhibits characteristics of malware or spyware. The permission combination is extraordinarily invasive - it can intercept and modify all web traffic, access your location, manage other extensions, capture your screen, access your identity and email, and inject scripts into every website you visit. The ability to block web requests combined with access to all URLs creates a perfect surveillance and data theft mechanism. The geolocation, desktopCapture, and identity permissions are particularly concerning for an extension with unclear legitimate purposes. The enterprise.deviceAttributes permission suggests corporate monitoring capabilities being used inappropriately.

Recommendations:

Do not install this extension under any circumstances. If already installed, remove it immediately and run a full security scan of your system. Check for any unauthorized changes to browser settings, saved passwords, or personal accounts. Consider changing passwords for sensitive accounts accessed while this extension was active. The permission set and poor reputation strongly suggest this is malicious software designed for surveillance, data theft, or system compromise.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: management

This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: geolocation

This extension has the geolocation permission. Can access your location.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

webRequest
<all_urls>
webRequestBlocking
tabs
background
storage
geolocation
gcm
management
identity
identity.email
enterprise.deviceAttributes
notifications
desktopCapture
unlimitedStorage
system.storage
nativeMessaging
idle
activeTab

Embedded URLs (216 total):

http://www.apache.org/licenses/	http://www.apache.org/licenses/LICENSE-2.0
https://fontawesome.com/license/free.	https://creativecommons.org/licenses/by/4.0/
https://scripts.sil.org/OFL	https://opensource.org/licenses/MIT
https://angular.io/	https://angular.io/license
https://www.w3schools.com/css/css3_animations.asp	http://shouldiprefix.com/
http://bit.ly/IWukam	https://github.com/jquery/jquery/blob/master/src/css/hiddenVisibleSelectors.js#L12
https://github.com/angular/angular/issues/22559	https://developer.mozilla.org/en-US/docs/Web/CSS/scroll-behavior
https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullScreen	https://github.com/WICG/EventListenerOptions/blob/gh-pages/explainer.md
https://medium.com/	https://bugzilla.mozilla.org/show_bug.cgi?id=33654
http://example.com#/foo	http://example.com/foo
https://en.wikipedia.org/wiki/Uniform_Resource_Locator#Syntax	http://cldr.unicode.org/translation/date-time
http://cldr.unicode.org/translation/number-patterns	https://www.w3.org/TR/NOTE-datetime
http://www.unicode.org/reports/tr35/tr35-dates.html#Date_Field_Symbol_Table	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/parse
https://en.wikipedia.org/wiki/ISO_4217	https://github.com/MikeMcl/big.js/
http://cldr.unicode.org/index/cldr-spec/plural-rules	http://plnkr.co/edit/KVuXxDp0qinGDyo307QW?p=preview
https://angular.io/docs/ts/latest/api/common/index/NgFor-directive.html#	https://github.com/angular/angular/issues/13407
http://2ality.com/2017/07/regexp-unicode-property-escapes.html	https://mothereff.in/regexpu#input=var+regex+%3D+/%5Cp%7BL%7D/u%3B&unicodePropertyEscape=1
http://userguide.icu-project.org/formatparse/messages.	https://en.wikibooks.org/wiki/Arithmetic/Rounding
http://bugs.jquery.com/ticket/1450	http://www.w3.org/TR/html51/syntax.html#named-character-references
https://html.spec.whatwg.org/multipage/entities.json	https://github.com/dart-lang/angular/blob/0bb611387d29d65b5af7f9d2515ab571fd3fbee4/_tests/test/compiler/preserve_whitespace_test.dart
http://www.w3.org/TR/html51/syntax.html#optional-tags	https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
https://github.com/angular/angular/issues/23440	http://www.w3.org/TR/html51/syntax.html#writing
http://www.w3.org/TR/html5/syntax.html#preprocessing-the-input-stream	https://www.w3.org/TR/html5/syntax.html#closing-elements-that-have-implied-end-tags
http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf	https://github.com/google/closure-compiler/blob/master/src/com/google/javascript/jscomp/GoogleJsMessageIdGenerator.java
http://www.danvk.org/hex2dec.html	http://docs.oasis-open.org/xliff/v1.2/os/xliff-core.html
http://docs.oasis-open.org/xliff/v1.2/xliff-profile-html/xliff-profile-html-1.2.html	http://docs.oasis-open.org/xliff/xliff-core/v2.0/os/xliff-core-v2.0-os.html
https://docs.google.com/document/d/1U1RGAehQwRypUTovF1KRlpiOFze0b-_2gc6fAH0KY0k/edit	https://github.com/angular/angular/pull/11846
https://github.com/webcomponents/webcomponentsjs/blob/4efecd7e0e/src/ShadowCSS/ShadowCSS.js	https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#styles
https://github.com/angular/angular/pull/17677	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp
https://github.com/dart-lang/angular/blob/0bb611387d29d65b5af7f9d2515ab571fd3fbee4/_tests/test/compiler/preserve_whitespace_test.dart#L25-L32	https://github.com/Microsoft/TypeScript/blob/master/src/compiler/utilities.ts
http://g.co/ng/security	https://github.com/google/traceur-compiler/blob/9511c1dafa972bf0de1202a8a863bad02f0f95a8/src/runtime/url.js
http://www.gbiv.com/protocols/uri/rfc/rfc3986.html#RFC2234	http://www.ics.uci.edu/pub/ietf/uri/#Related
https://github.com/Microsoft/TypeScript/issues/12439	https://w3c.github.io/webcomponents/spec/shadow/
http://www.w3.org/2000/svg/	http://www.w3.org/1998/MathML/
https://stackblitz.com/edit/lifecycle-hooks-vcref	https://github.com/jhusain/observable-spec
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/map	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/find	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/reduce
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/some
https://github.com/cure53/DOMPurify/blob/a992d3a75031cb8bb032e5ea8399ba972bdf9a65/src/purify.js#L439-L449	https://github.com/cure53/DOMPurify/releases/tag/0.6.7
http://g.co/ng/security#xss	http://dev.w3.org/html5/spec/Overview.html#semantics

Page 1 of 3

Raw Manifest

{
  "name": "Mobile Guardian",
  "icons": {
    "16": "assets/images/mg-16.png",
    "128": "assets/images/mg-128.png"
  },
  "version": "2.2.68",
  "commands": {
    "shareActiveTab": {
      "description": "Shares the active tab",
      "suggested_key": {
        "mac": "Command+Shift+O",
        "default": "Ctrl+Shift+O"
      }
    }
  },
  "background": {
    "scripts": [
      "background_app/config.js",
      "background_app/md5.min.js",
      "background_app/helpers.js",
      "background_app/api.js",
      "background_app/api-request.js",
      "background_app/heads-up.js",
      "background_app/heads-up-window.js",
      "background_app/heads-up-windows-native.js",
      "background_app/filter.js",
      "background_app/queue.js",
      "background_app/auto-register.js",
      "background_app/application-sync.js",
      "background_app/application-log.js",
      "background_app/application-events.js",
      "background_app/application-block.js",
      "background_app/applications.js",
      "background_app/chrome-storage.js",
      "background_app/location.js",
      "background_app/tab-control.js",
      "background_app/student.js",
      "background_app/debug.js",
      "background_app/gcm.js",
      "background_app/sync.js",
      "background_app/tab-control.js",
      "background_app/deviceInfo.js",
      "background_app/screen-capture.js",
      "background_app/self-help.js",
      "background_app/log.js",
      "background_app/classes.js",
      "background_app/screen-capture-webrtc.js",
      "background_app/screen-capture-share.js",
      "background_app/screen-capture-socket.js",
      "background_app/device-cast.js",
      "background_app/socket.io.js",
      "background_app/connectivity_checker.js",
      "services-unavailable.js",
      "background.js"
    ]
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Mobile Guardian App",
  "permissions": [
    "webRequest",
    "<all_urls>",
    "webRequestBlocking",
    "tabs",
    "background",
    "storage",
    "geolocation",
    "gcm",
    "management",
    "identity",
    "identity.email",
    "enterprise.deviceAttributes",
    "notifications",
    "desktopCapture",
    "unlimitedStorage",
    "system.storage",
    "nativeMessaging",
    "idle",
    "activeTab"
  ],
  "browser_action": {
    "default_icon": {
      "16": "assets/images/mg-16.png",
      "128": "assets/images/mg-128.png"
    },
    "default_title": "Mobile Guardian"
  },
  "optional_hosts": {},
  "content_scripts": [
    {
      "js": [
        "background_app/hide-youtube-queue-video.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://www.youtube.com/",
        "https://www.youtube.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "background_app/blank-page.js",
        "background_app/connectivity_checker.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false
    }
  ],
  "manifest_version": 2,
  "web_accessible_resources": [
    "block.html",
    "services-unavailable.html"
  ]
}

by ✦ Astarte

Mobile Guardian

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (216 total):

Raw Manifest

Detections

Manifest Findings