Is AegisWeb3 safe?
AegisWeb3 is medium risk. AegisWeb3's background script scans every open tab for its own ID, reads referral param 's2' from the newest match, and sends it to approve.aegisweb3.com. Testing confirmed a planted marker reached the server in seconds.…
Who publishes itAegisWeb3 - no other listings under this identity
AegisWeb3 - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AegisWeb3 Scans Every Open Tab for a Referral Code at Install
AegisWeb3's background script scans every open tab for its own ID, reads referral param 's2' from the newest match, and sends it to approve.aegisweb3.com.
Testing confirmed a planted marker reached the server in seconds.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install AegisWeb3 while a tab is open to a URL that contains the extension's own ID and a referral code.
That is typically the Chrome Web Store listing itself, which can carry an affiliate 's2' code in its URL, but the check is not restricted to the Chrome Web Store's domain.
The extension reads that referral code and sends it to its own server, approve.aegisweb3.com.
This happens once, automatically, right after install, with no notification shown to you.
- Referral code (s2)REF-8842-CG (illustrative)
Ties this specific install to whichever referral link or ad campaign the code came from. This is the only value sent to AegisWeb3's server.
- Open tab's web addresshttps://chromewebstore.google.com/detail/aegisweb3/dakkielolpafjbgnjnakddabmbbkcioe?s2=REF-8842-CG (illustrative)
Read locally on every tab to find one matching the extension's own ID. Only the referral code from the first match leaves the device.
The install handler that scans open tabs and reports the referral code
chrome.runtime.onInstalled.addListener(async () => { const tabs = (await chrome.tabs.query({})).reverse(); // most recently opened tab first for (const tab of tabs) { const url = tab.url || ''; if (url.toLowerCase().indexOf('dakkielolpafjbgnjnakddabmbbkcioe') <= 0) continue; // not a matching tab // First tab whose URL contains the extension's own ID string — // usually the Chrome Web Store listing the user just installed from, // but the check is a plain substring test, not a domain check. const s2 = new URL(url).searchParams.get('s2'); if (s2) { fetch(`https://approve.aegisweb3.com/api/User/PluginData?s2=${s2}`).catch(() => {}); } break; // only the first matching tab is ever inspected }});200 OK. Observed during dynamic analysis after the referral code was read from a matching tab.
Reproduces AegisWeb3's install-time tab-matching logic locally: given a list of open-tab URLs, it shows which one the extension would match and what request it would send, without contacting any server.
- Node.js 14+
#!/usr/bin/env node// aegisweb3-install-tab-scan-reproducer.js//// Reproduces the tab-matching logic from AegisWeb3's chrome.runtime.onInstalled// handler (js/background.js). Given one or more "open tab" URLs (pass them in// the order chrome.tabs.query({}) would return them — oldest tab first), it// prints which tab the extension would match and what request it would send.// It never makes a network request itself.const EXTENSION_ID = 'dakkielolpafjbgnjnakddabmbbkcioe';function findOutboundRequest(openTabUrls) { // The real handler calls chrome.tabs.query({}) then .reverse()s the // result, so the most-recently-opened tab is checked first. const tabs = [...openTabUrls].reverse(); for (const url of tabs) { if (url.toLowerCase().indexOf(EXTENSION_ID) <= 0) continue; // Matched a tab whose URL contains the extension's own ID. const parsed = new URL(url); const s2 = parsed.searchParams.get('s2'); if (s2) { return `https://approve.aegisweb3.com/api/User/PluginData?s2=${s2}`; } return null; // matched, but no s2 parameter on this tab's URL } return null; // no open tab contained the extension's own ID}const testUrls = process.argv.slice(2);if (testUrls.length === 0) { console.log('Usage: node aegisweb3-install-tab-scan-reproducer.js <tab-url> [<tab-url> ...]'); process.exit(1);}const request = findOutboundRequest(testUrls);console.log(request ? `AegisWeb3 would send: GET ${request}` : 'No matching tab, or no s2 parameter on the matching tab — no request would be sent.');- 1node aegisweb3-install-tab-scan-reproducer.js "https://chromewebstore.google.com/detail/aegisweb3/dakkielolpafjbgnjnakddabmbbkcioe?s2=REF-1234"
Site block list fetched hourly from unsigned Alibaba Cloud bucket
Every hour, the extension downloads a blocked-domains file from Alibaba Cloud storage.
New domains join the block list immediately with no update.
The file is unsigned, so whoever controls the bucket can add domains anytime.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
Once per hour, the background service worker wakes up and fetches the remote blocklist file.
The fetch runs at startup and repeats every 60 minutes regardless of user activity.
The downloaded domain list is stored locally and applied to every page you visit.
Any domain the remote operator adds to the list will cause the extension to intercept and replace that site with a block-list warning page.
On an interval
Blocklist is refreshed from the remote server every hour, starting immediately on extension load.
Hourly blocklist fetch in background service worker
// background.js — runs every hour starting on installscheduleHourly({ interval: 1, runNow: true, time: '00:00:00' }, async () => { const response = await fetchJson( 'https://aegis-static.oss-accelerate.aliyuncs.com/ext/phishing-back-list.json' ); if (response?.blacklist?.length > 0) { await chrome.storage.local.set({ blacklist: response.blacklist }); }});- aegis-static.oss-accelerate.aliyuncs.com
Alibaba Cloud OSS bucket operated by the developer. Serves the block list as a plain unsigned JSON file. Whoever controls it can add any domain without a new extension version.
What it can do
Permissions this extension asks for, as declared in version 0.7.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Read and change your data on approve.aegisweb3.com
https://approve.aegisweb3.com/*
Store data in your browser
storage
See the address and title of every tab you have open
tabs