PT-2025-41313 · Google · Web Developer For Chrome

Published 2025-10-08 · Updated 2025-10-14 · CVE-2017-20202

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Web Developer for Chrome versions prior to 0.5.0

Description The Web Developer for Chrome extension contained malicious code that generated a domain using a domain generation algorithm (DGA) and retrieved a remote script. This script loaded modules that performed ad substitution, malvertising, redirection to affiliate programs via fake “repair” alerts, and attempted to steal credentials during user login. Injected components identified common banner sizes for ad replacement and redirected traffic to affiliate websites. Potential consequences included user-level code execution within the browser, large-scale ad fraud, traffic hijacking, credential theft, and exposure to further malicious payloads.

Recommendations Update to Web Developer for Chrome version 0.5.0 or later.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2017-20202

Affected Products

Web Developer For Chrome

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-20202 · Security Note
• https://t.me/cveNotify/138542 · Telegram Post
• https://gist.github.com/piedpiperRichard/076516da60f45842f1a6e6ae35a9a240 · Note
• https://web.archive.org/web/20170803163618/https://chrispederick.com/blog/web-developer-for-chrome-compromised · Note
• https://chromewebstore.google.com/detail/web-developer/bfbameneiokkgbdmiekhjnmfkcnldhhm?pli=1 · Note
• https://vulncheck.com/advisories/web-developer-for-chrome-malicious-backdoor-supply-chain-compromise · Note
• https://ui.vision/blog/chrome-extension-adware · Note
• https://proofpoint.com/us/threat-insight/post/threat-actor-goes-chrome-extension-hijacking-spree · Note
• https://t.me/cveNotify/137910 · Telegram Post