View Earth & Satellite Maps

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension View Earth & Satellite Maps injects a widget that draws map data on every page. The only network activity observed is a fetch call from earth-widget.js:1 (recorded as NET-FETCH-earth-widget.js-1), which retrieves map tiles and location suggestions from the public Bing Maps endpoints https://dev.virtualearth.net/REST/v1/Locations?query=$ and https://dev.virtualearth.net/REST/v1/Autosuggest?query=$. Those URLs are standard parts of the Bing Maps service and are not indicative of malicious intent.

In addition to the Bing endpoints, the extension references its own hosting domain https://viewearthsatellite.com/* and the associated FAQ page (https://viewearthsatellite.com/faq.html). The XIOC extractor also flagged several short‑hand domains such as e.city, e.lat‑t.lat, t.center, a.lat‑o.lat, and n.open. These strings appear in the minified JavaScript as parts of internal URL construction or placeholder variables; they are not fully‑qualified domains that the extension contacts over the network. The presence of https://clients2.google.com/service/update2/crx is a standard Chrome update check URL and is benign.

No malware‑signature rules matched, and the findings list shows zero entries under malware-signature and malware. There are also no obfuscation findings, no secret or credential exposure, and no code‑smell detections that would suggest deliberate abuse of APIs. The extension’s manifest does not request elevated permissions beyond what is needed to inject the widget and perform fetch requests, further supporting a low‑risk profile.

A skeptic might argue that the numerous domain‑like strings flagged by the IOC extractor indicate hidden tracking or data exfiltration to obscure servers. However, the extractor is known to produce many false positives, especially for short or fragmented domain fragments found in minified code. In this case, none of the flagged strings correspond to reachable domains when resolved, and the only confirmed outbound requests are to well‑known map services and the extension’s own website, both of which are disclosed in the widget’s functionality. Moreover, the extension does not request permissions to read cookies, tabs, or browsing history, which would be required for covert data harvesting.

Overall, the evidence points to a legitimate map‑widget extension that simply loads public map resources and its own help page. While the widget does add network traffic to third‑party mapping services, this behavior aligns with its advertised purpose and does not constitute malicious activity.

Key Reasons

• No malware signatures or obfuscation detected
• Network fetches only to public map APIs and the extension's own domain
• IOC findings consist mainly of short fragments typical of false positives

False Positive Considerations

• IoC extractor generic domain fragments
• No malicious signatures matched
• Absence of obfuscation or credential‑related code

Reviewed 2026-05-28; recommended action: no action; model confidence 86%.