Floating Video with Playback Controls

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension Floating Video with Playback Controls declares the tabs permission in manifest.json, which is common for a feature that needs to insert a floating video player into active pages. The most alarming findings are three high‑severity YARA matches titled YARA--postinstall_file_download, YARA--postinstall_obfuscation, and YARA--postinstall_network_communication all reported against unknown_file. These rules belong to the widely‑used postinstall_ family that fire on any code performing a download, using basic obfuscation patterns, or opening a network socket during installation. In the CVEQ platform they are documented as low‑value “code‑smell” signatures that generate false positives on legitimate extensions and should not be treated as evidence of malware.

Beyond the YARA hits, the only behavioural findings are a series of socket.io connections and a fetch request. The network entries list the file and line where the call occurs – for example content.js:2093, background.js:2094, and settings.js:1934 – but they do not disclose any destination domain. Without a suspicious host, these calls are typical for extensions that sync settings, check for updates, or load auxiliary scripts. No IoC extractor flagged any external domain, and the summary deliberately shows zero IoC entries.

The extension’s code‑smell count (39 entries) is high, but all are classified as low‑severity patterns such as the use of eval, generic string concatenations, or untyped variables. According to the platform’s guidance, such findings are expected in minified or bundled JavaScript and do not imply malicious intent. There is no evidence of credential access, browser‑hijacking logic, or proxy functionality. The publisher is identified only by a personal Gmail address, which is unusual but not itself malicious; the extension has 90 000 users and a clear functional description, supporting the view that it is a legitimate utility rather than a deceptive copycat.

Counterargument: A skeptical analyst might argue that the combination of high‑severity YARA matches and multiple socket‑io connections indicates a post‑install payload that could download and run unwanted code. However, the YARA rules that triggered are known to over‑match on benign code that merely includes a download helper or a basic obfuscation routine. Moreover, the network findings lack concrete host information, and no malicious payload was observed in any file path. Without a specific malicious domain, file, or payload, the evidence does not rise above the threshold for a confirmed or even a confirmed‑risk verdict.

In summary, the extension exhibits typical behaviour for a picture‑in‑picture utility, and the flagged findings are best explained by generic rule noise and normal bundled dependencies. No actionable malicious indicators were identified.

Key Reasons

• High‑severity YARA matches are generic postinstall rules known to generate false positives
• No suspicious domains appear in network findings; calls are limited to socket.io and fetch without destination details
• All code‑smell detections are low‑severity patterns common in bundled JavaScript
• Extension functionality matches its description and does not attempt credential or browser hijacking

False Positive Considerations

• generic postinstall YARA signatures
• code‑smell noise from bundled dependencies
• absence of disclosed external domains
• high count of low‑severity findings

Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 78%.