Is VU Quiz Firewall safe?

High risk

VU Quiz Firewall is high risk. The extension starts a background loop when the service worker runs. Every 3 seconds it lists installed Chrome extensions, stores the list locally, and disables any extension whose ID is not its own. Testing had no other extension present.

IT Department, Virtual University of Pakistanv1.2.0.7Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-940
SourceAI SANDBOX

Recurring disable loop for other extensions

The extension starts a background loop when the service worker runs.

Every 3 seconds it lists installed Chrome extensions, stores the list locally, and disables any extension whose ID is not its own.

Testing had no other extension present.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension and Chrome starts its background worker.

No quiz page has to be open for the worker code to schedule its recurring check.

The extension did this

The extension repeatedly lists your installed add-ons and asks Chrome to turn off every other extension.

The loop repeats every 3 seconds and excludes only VU Quiz Firewall's own extension ID.

02EvidenceFIELD TABLE
Installed-extension fields used by the background loop
FieldValueWhy it matters
Other extension ID
aapocclcgogkmnckokdopfmhonfmgoek (illustrative)Shows which add-ons are installed in your browser. Uncommon combinations can distinguish one browser profile from another.
Item type
extensionLets the loop separate extensions from other Chrome-managed items before taking action.
Saved extension list
chrome.storage.local extData = JSON.stringify(installedExtensions)Keeps a local copy of the installed-extension list that the quiz-page content script can read later.
Disable target
setEnabled(otherExtensionId, false)Marks every other installed extension as eligible to be turned off by Chrome.
03EvidenceTEMPORAL PATTERN
When this fires
Every 3 seconds

The background worker repeats the installed-extension check every 3 seconds while it is running.

04EvidenceCODE COMPARE
The code that does this

The background worker stores the extension list and disables other extensions

What it actually does
Deobfuscated background.jsbackground.js
try {
  setInterval(CheckInstallExtensions, 3000);
} catch {
  console.log(chrome.runtime.lastError);
}

function CheckInstallExtensions(s) {
  chrome.management.getAll(function(e) {
    if (e) {
      try {
        const data = JSON.stringify(e);
        chrome.storage.local.set({
          extData: data
        }, function(e) {
          if (chrome.runtime.lastError);
        });
      } catch (err) {
        console.log(err);
      }
      e.forEach(function(item) {
        try {
          if (item.type == "extension" && item.id != chrome.runtime.id) {
            chrome.management.setEnabled(item.id, false, function(e) {
              if (chrome.runtime.lastError);
            });
          }
        } catch (err) {
          console.log(err);
        }
      });
    }
  });
}
05EvidenceCODE COMPARE
The code that does this

The quiz-page script reads the stored extension list

What it actually does
Deobfuscated content-script.jscontent-script.js
chrome.storage.local.get(["extData"], function(obj) {
  try {
    if (window.location.href.indexOf("QuizStart.aspx") > -1 || window.location.href.indexOf("QuizQuestion.aspx") > -1 || window.location.href.indexOf("ExtensionDetected.aspx") > -1) {
      if (obj.extData != null) {
        let extBrowserList = JSON.parse(obj.extData),
          index = 0,
          extFound = false;
        for (index = 0; index < extBrowserList.length; index++) {
          if (extBrowserList[index].type == "extension" && extBrowserList[index].id != chrome.runtime.id) extFound = true;
          else try {
            delete extBrowserList[index];
          } catch {}
        }
        if (extFound === true) {
          try {
            localStorage.setItem("sysdata", JSON.stringify(extBrowserList));
          } catch (error) {
            console.error("Error saving to localStorage", error);
          } finally {
            if (window.location.href.indexOf("ExtensionDetected.aspx") < 0) window.location.href = "ExtensionDetected.aspx";
          }
        }
      } else {
        window.location.href = "ExtensionNotInstalled.aspx";
      }
    }
  } catch (err) {
    console.error("Error processing extension data", err);
  }
});
06EvidencePLAIN NOTE
Dynamic-analysis caveat

Dynamic analysis observed the background worker repeatedly writing extension-list data on the expected cadence. The test profile contained only this extension, so there was no separate extension available for Chrome to disable during that run.

Updated 10 September 2026gbiahfedloaennjklbmekkhoojlaffcc