Malwarebytes Browser Guard

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Malwarebytes Browser Guard is a content-blocking extension from Malwarebytes, a security vendor with a long public track record, published on the Firefox store with roughly 451,000 users. Version 3.3.6 produced eight findings, four of them high severity. The four high findings are all the same rule, YARA--mag_php_js, matching at content-scripts.js:2, content-scripts.js.map:1, background.js:2 and background.js.map:1. The two medium findings are network hits from app/scripts/exclusions/exclusions-mv3.js and content-oap-google.js. Two manifest-analysis findings are also present but carry no description.

The malware-signature matches deserve a close look because of the severity label, but the shape of the evidence undercuts them. A signature that fires at line 2 of a bundle and line 1 of that bundle's source map is matching a broad pattern across the whole file rather than a specific payload. content-scripts.js and background.js are build outputs, and .js.map files are compiler debug artifacts produced by webpack or esbuild that an attacker has no reason to add. YARA--mag_php_js is a generic PHP/JavaScript web-shell style rule of the sort that trips on packed or encoded text, well below the specificity of a named family signature like a banking trojan or infostealer rule. Nothing else in the scan backs it up. There are no IoC findings, no obfuscation findings, no leaked secrets and no dependency findings. An actual supply-chain compromise dropping a payload into background.js would leave more than one vague rule match, and it would very likely leave at least one endpoint for receiving stolen data.

The two network findings fit the extension's stated job. content-oap-google.js is the content script that handles Google search result pages, the path a content blocker needs to mark or remove ad results, and app/scripts/exclusions/exclusions-mv3.js is the exclusions module, where a blocker fetches the list of sites a user has excluded from filtering. Neither one is a monetized redirect, a tracking collector or a proxy relay. There is no search-hijack behavior in the evidence: no custom search domain, no new-tab replacement, nothing contradicting the "block trackers, ads, phishing" description.

The counterargument is straightforward. A high-severity malware signature is labeled high severity for a reason, and four of them in the core scripts of an extension is not nothing. Someone could fairly argue that Malwarebytes' own bundles should be clean of anything resembling a web shell. That argument would carry more weight if the matches were hits on a narrow family pattern, or if they clustered at one offset in one file. Instead the same rule hits at line 2 of background.js and line 1 of the matching .map, which is what a broad pattern match against generated code looks like. Add a publisher whose entire business is blocking malicious code, and no corroborating signal anywhere in the scan, and the findings read as scanner noise rather than extension behavior.

What would change this: a network finding to a domain that is neither Google nor Malwarebytes-controlled, an obfuscation finding in the same file as the signature, or a YARA match on a named malware family rather than a generic PHP/JS rule.

Key Reasons

• All four high-severity hits are the same generic rule, YARA--mag_php_js, matching at line 1-2 of background.js, content-scripts.js and their .js.map source maps, which are generated build artifacts.
• No corroborating evidence anywhere in the scan: zero IoC, obfuscation, secret, dependency, code-smell or tool-poisoning findings that would accompany a real payload.
• Network findings are limited to content-oap-google.js (Google search result handling) and app/scripts/exclusions/exclusions-mv3.js (the extension's own exclusion list fetch), neither of which is an exfiltration or redirect endpoint.
• Publisher is Malwarebytes, a known security vendor, on the Firefox store with ~451,000 users and a versioned release (3.3.6).
• No browser-hijack signals: no custom search domain, no new-tab replacement, no dynamic URL template construction in the evidence.

False Positive Considerations

• Generic PHP/JavaScript YARA rule (YARA--mag_php_js) matching minified bundle output rather than a named malware family
• Matches extend to .js.map source maps, a hallmark of a file-wide pattern match on machine-generated code
• Zero IoC, obfuscation, secret or dependency findings that normally accompany a real injected payload
• Remaining findings are the extension's own functional network calls (Google search handling, exclusions list)

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 88%.