Flash Player 2026

AI Security Review

Evidence context: threat category supply chain; evidence quality strong.

Architectural red flags in a working Flash emulator

This extension bundles the real Ruffle WASM Flash emulator and it does correctly play .swf files. The problem is not the Flash emulation — it's the infrastructure wrapped around it.

Remote-controlled content script injection

On a 1-hour alarm, bg.js calls https://api.modernkit.one/ext-activations/get-features with a device-unique UUID and receives a response field called alternateDetectionConfigv2. Each entry in that list contains a base64-encoded hostname. The extension decodes those hosts at runtime (atob(alternateConfig.host)) and calls chrome.scripting.registerContentScripts() to inject detection-alternate.js into every matching site, in the MAIN world, at document_start.

This means the publisher — not the store, not the user, not a code audit — decides at runtime which websites this extension injects code into. No extension update is required to re-target. The base64 encoding of the target list in the API response is consistent with deliberately obscuring the target set from static review.

XHR interception on the server-chosen targets

The injected detection-alternate.js overrides XMLHttpRequest.prototype.open and inspects every response body matching a server-provided regex:

var mk1CheckPath = atob(mk1AlternateConfig.path);
var mk1CheckBody = atob(mk1AlternateConfig.body);
// ...
window.XMLHttpRequest.prototype.open = function (method, url, isAsync) {
    if (url.indexOf(mk1CheckPath) > -1) {
        this.addEventListener('load', () => {
            // walks response body, extracts fields by server-provided key paths
        });
    }
    return mk1OriginalXHROpen.apply(this, arguments);
};

The fields that get stripped before data leaves the page are also controlled by the server, via an excludeKeys list. If the server returns an empty exclude list, the full response body flows out through an invisible <iframe id='mk1PageBridge'>.

Privileges far in excess of stated purpose

The manifest requests:

• <all_urls> host permissions
• declarativeNetRequestWithHostAccess — can rewrite network requests
• scripting — can inject arbitrary scripts at runtime
• Content scripts at document_start in the MAIN world on every HTTP(S) page

A Flash emulator only needs to replace <object type="application/x-shockwave-flash"> elements where Flash is actually embedded. It does not need to modify network requests, dynamically register content scripts, or run at document_start on every site.

The exclude list is security theater

The manifest exclude_matches carves out banking and auth sites (authentication.td.com, sso.godaddy.com, duosecurity.com) from the static content scripts, which looks compliant on audit. But the dynamically-registered scripts from registerContentScripts() do not inherit this exclude list. Whatever hosts modernkit.one pushes into alternateDetectionConfigv2 get the injection, regardless of what the static manifest promises.

Telemetry and attribution

• Device-unique UUID stored in chrome.storage and sent with every API call
• Install, post-install, and uninstall URLs include UTM parameters that identify the extension and the installation channel
• /stats endpoint called on multiple lifecycle events
• /ext-activations/check-utm endpoint sends tracking data back on a 1-hour schedule

Assessment

Even if the current server-side target list is benign — say, extracting Flash content from specific video sharing sites — the architecture itself is a remote-controlled backdoor. The publisher reserves the right to inject arbitrary JavaScript into any website of their choosing, intercept XHR responses there, and exfiltrate fields of their choosing, all without any extension update or user consent after install.

This is not a “false positive YARA rule” case. The malicious capability is intentional, documented in code, and gated only by whatever modernkit.one decides to do with their admin panel. A future update to the API response could retarget this to banking sites, crypto exchanges, or auth portals.

Do not install. If you already have it installed, uninstall it. If you run an enterprise environment, block the extension ID fgenmmklgkdemhpgdppmldmkemplbcko and the domain modernkit.one.

Key Reasons

• Dynamically registers MAIN-world content scripts on a remote-provided, base64-encoded target list
• Overrides XMLHttpRequest.prototype.open on server-chosen sites to sniff response bodies
• Manifest exclude_matches is bypassed by runtime-registered scripts
• Privileges (all_urls, scripting, declarativeNetRequest) vastly exceed what a Flash emulator needs
• Device fingerprinting and UTM attribution telemetry unrelated to Flash playback

Reviewed 2026-04-14; recommended action: takedown request; model confidence 90%.