Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io
View Driving Directions
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 5 months ago
- Version
- v1.0.9
- Artifact
- SHA256 3D4…3CF
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
Requested Permissions
3 permissionsAI Security Report
AI Security Review
Evidence context: threat category adware; evidence quality moderate.
Security Analysis: View Driving Directions
This extension presents concerning indicators of adware or browser hijacking behavior. While it claims to "show a driving directions widget on every page," the network connections reveal activity inconsistent with legitimate mapping functionality.
Suspicious Network Domains
The extension connects to five domains with highly suspicious patterns: e.style.top, e.center, a.lat-o.lat, e.ms, and t.tab.id. These domains share characteristics typical of ad networks and tracking infrastructure: single-character subdomains combined with monetization-friendly TLDs (.top, .lat, .id). None of these domains are associated with legitimate mapping services. The Bing Maps API (dev.virtualearth.net) is legitimately used for geolocation services, but the additional suspicious domains serve no clear purpose for a directions widget.
Publisher and Adoption Concerns
The developer is listed as [email protected], an anonymous Gmail address with no company attribution or developer verification. The extension has zero users, indicating it is either brand new or has been abandoned. This anonymity combined with suspicious network activity is a significant risk indicator.
Absence of Malware Signatures
No malware signatures were detected in the code, and there are no obfuscation findings. However, the absence of malware signatures does not rule out adware behavior. Browser hijackers and adware often operate without traditional malware signatures while still compromising user experience and privacy through unwanted tracking and ad injection.
Counterargument Consideration
A skeptic might argue that the extension is benign, with the suspicious domains being third-party ad services used for monetization. However, legitimate extensions from verified publishers typically disclose such partnerships, and the domains' naming patterns (e.style.top, e.ms) are characteristic of stealth adware rather than transparent advertising networks. The mismatch between the extension's stated purpose (driving directions) and its actual network activity (connections to ad-like domains) suggests deceptive behavior.
Conclusion
This extension exhibits confirmed risk characteristics: anonymous publisher, suspicious ad/tracking domains inconsistent with stated functionality, and zero user adoption. While not confirmed malware, the evidence strongly indicates adware or browser hijacking behavior that could expose users to unwanted tracking and monetization schemes.
Key Reasons
- Five suspicious ad/tracking domains (e.style.top, e.center, a.lat-o.lat, e.ms, t.tab.id) do not align with driving directions functionality
- Anonymous Gmail developer with no company attribution
- Zero user count indicates new or abandoned extension
- No malware signatures but network activity suggests adware behavior
False Positive Considerations
- Bing Maps API (dev.virtualearth.net) is legitimate geolocation service
- mapsdrivingdirections.com and viewmapsdirections.com appear to be extension's own domains
Reviewed 2026-06-02; recommended action: monitor; model confidence 75%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Edge Translate - Text Selection Translation
[email protected]
Intelbras Cloud
[email protected]
Edge Translate - Browser Translator | PDF Translation | MV3 | Open Source
[email protected]
SlingPlayer for DISH Anywhere
Unknown Developer
Berry Adblock - No Ads, More Berries.
[email protected]
MV3前端助手
[email protected]