# One of 30 extensions is likely intermittently hijacking tabs

**URL:** <https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309>\
**Category:** addons.mozilla.org\
**Created:** [July 20, 2018, 5:08pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309 "2018-07-20T17:08:48Z")\
**Posts on this page:** 12\
**Page:** 2

<div class="post-metadata">

**Author:** ![jscher2000](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/jscher2000/32/28202_2.png) [@jscher2000](https://discourse.mozilla.org/u/jscher2000)\
**Post date:** [July 24, 2018, 12:22am UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/21 "2018-07-24T00:22:11Z")

</div>

> [@cattledogit](#):
>
> How could an extension apparently removed from [addons.mozilla.org](http://addons.mozilla.org) continue to be updated in FF?

I don’t think an extension can update to a nonexistent version, but unless a block is deployed, it won’t be disabled or rolled back, either. Extensions have to be nominated for blocking through a separate process from review.

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [July 24, 2018, 4:07am UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/22 "2018-07-24T04:07:15Z")

</div>

> [@cattledogit](#):
>
> Did you reject the July 6th update, but it was installed anyway? Shouldn’t rejected updates be blocked from being installed?

Version 2.3.1.0 · July 5, 2018 had a feature to “ask for feedback” every 7 days. That included opening the `lzpv4rsmat(dot)com`  
Currently that does not result in automatic rejection and it is left to users to decided if the monetization system deployed by an add-on is desirable or not.

Version 2.3.2 · July 13, 2018 had more serious issues and was rejected the same day. Developer deleted his/her account after that.

Once all version of an add-on are rejected, the add-on will no longer update but it remains on users computers. If an add-on is blocked for serious issues (a totally different process by Admin) then it will be disabled on users’ Firefox as well.

---

<div class="post-metadata">

**Author:** ![bjh](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/bjh/32/21802_2.png) [@bjh](https://discourse.mozilla.org/u/bjh)\
**Post date:** [July 25, 2018, 11:11am UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/23 "2018-07-25T11:11:02Z")

</div>

> [@cattledogit](#):
>
> Yes, unfortunately text can’t be selected on the about:addons page.

Reported: 14 years ago

> **[246400 - Text in Add-Ons Manager Displays Should Be Selectable and Copyable](https://bugzilla.mozilla.org/show_bug.cgi?id=246400)**
>
> RESOLVED (nobody) in Toolkit - Add-ons Manager. Last updated 2019-10-16.

---

<div class="post-metadata">

**Author:** ![cattledogit](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@cattledogit](https://discourse.mozilla.org/u/cattledogit)\
**Post date:** [July 29, 2018, 10:13pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/24 "2018-07-29T22:13:58Z")

</div>

> [@erosman](#):
>
> Currently that does not result in automatic rejection and it is left to users to decided if the monetization system deployed by an add-on is desirable or not.

The problem with this approach is that it’s extremely time-consuming for a user to determine which add-on is opening the new tab. There should be an easier way than process of elimination to detect monetization systems that are added in an update, especially when they can open tabs intermittently rather than when the add-on is actually used.

What’s the best way to submit this concern, since it’s not bug per se?

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [July 30, 2018, 4:43am UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/25 "2018-07-30T04:43:53Z")

</div>

> [@cattledogit](#):
>
> What’s the best way to submit this concern, since it’s not bug per se?

@caitlin should be able to advise on this issue.

---

<div class="post-metadata">

**Author:** ![mpj220](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@mpj220](https://discourse.mozilla.org/u/mpj220)\
**Post date:** [August 1, 2018, 4:46pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/26 "2018-08-01T16:46:28Z")

</div>

My bet goes to “1-Click YouTube Video Downloader”

I have the same thing happening to me. Multiple tabs opening, fake flash update tabs.  
All are usually identified by Norton or Malwarebytes and are blocked.

This is my work PC and I have all of 2 add-ons. Adblock plus and 1-Click YouTube Video Downloader.

I just deleted the possible offender.

---

<div class="post-metadata">

**Author:** ![cattledogit](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@cattledogit](https://discourse.mozilla.org/u/cattledogit)\
**Post date:** [August 1, 2018, 8:47pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/27 "2018-08-01T20:47:26Z")

</div>

> [@erosman](#):
>
> @caitlin should be able to advise on this issue.

@caitlin brought this up at a team meeting, then replied:

> If you look at each extension listing on [addons.mozilla.org](http://addons.mozilla.org), you might be able to narrow down which extension is the culprit to the ones that use the ‘new tab’ permission. Otherwise, process of elimination is the best way to identify the extension causing the unwanted behavior.
> 
> We currently don’t have a policy against this kind of behavior, but it’s something we might discuss more in the future if we see more users complaining about a poor experience.

---

<div class="post-metadata">

**Author:** ![cattledogit](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@cattledogit](https://discourse.mozilla.org/u/cattledogit)\
**Post date:** [August 9, 2018, 7:28pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/28 "2018-08-09T19:28:20Z")

</div>

> [@mpj220](#):
>
> My bet goes to “1-Click YouTube Video Downloader”

Removing it stopped new tabs from opening for a week. When I removed it I installed “YouTube mp3 Downloader” from author “YouTube Download Tool” (there’s more than one “YouTube mp3 Downloader”), which requests no malicious permissions per [addons.mozilla.org](http://addons.mozilla.org).

Today however a tab opened to addonbrowser dot com/youtube-mp3-download?v=3.0.0&type=install that was flagged by Avast as potentially harmful, advertising “Mp3 Downloader for Youtube.”

A new window also popped open to www.pc.error2323219459ausmsauthcombof0807 “dot” [com.s3-website.us-east-2.amazonaws.com/assests/eng\_ff\_auth.html](http://com.s3-website.us-east-2.amazonaws.com/assests/eng_ff_auth.html)… with a “\*\* YOUR COMPUTER HAS BEEN BLOCKED.\*\*” message and an 877 number to call. It came with a repeating authentication popup “[http://www.winsupporthelp](http://www.winsupporthelp) “dot” club is requesting your username and password” that was impossible to dismiss without restarting FF.

---

<div class="post-metadata">

**Author:** ![Mittineague](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/mittineague/32/23743_2.png) [@Mittineague](https://discourse.mozilla.org/u/Mittineague)\
**Post date:** [August 9, 2018, 8:29pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/29 "2018-08-09T20:29:14Z")

</div>

This is **_very serious_**. A majority of so called “help” sites ask the unwary for access to their OS, and once given can do all manner of badness.

Have you done a full scan of your computer? It sounds like this may have less to do with any plugin and more to do with your computer being infected.

---

<div class="post-metadata">

**Author:** ![cattledogit](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@cattledogit](https://discourse.mozilla.org/u/cattledogit)\
**Post date:** [August 9, 2018, 8:59pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/30 "2018-08-09T20:59:08Z")

</div>

I’ve run scans with Malwarebytes and Avast. I’ve just changed my default browser to MS Edge (again) so I can be sure, and I’ll report back if Edge is opened. However, there’s no policy against extensions doing this:

> [@cattledogit](#):
>
> We currently don’t have a policy against this kind of behavior, but it’s something we might discuss more in the future if we see more users complaining about a poor experience.

---

<div class="post-metadata">

**Author:** ![cattledogit](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@cattledogit](https://discourse.mozilla.org/u/cattledogit)\
**Post date:** [August 11, 2018, 2:39pm UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/31 "2018-08-11T14:39:11Z")

</div>

I disabled “YouTube mp3 Downloader” and haven’t seen an ad in a couple of days. I now see reviews for the addon that say: “tries to open scam pages and phishing pages” (2 days ago) and “…and it’s been opening ads in my browser. Deleted and ads are gone.” (13 days ago).

> [@cattledogit](#):
>
> If you look at each extension listing on [addons.mozilla.org](http://addons.mozilla.org), you might be able to narrow down which extension is the culprit to the ones that use the ‘new tab’ permission.

“YouTube mp3 Downloader” isn’t shown to use the “new tab” permission.

---

<div class="post-metadata">

**Author:** ![cattledogit](https://avatars.discourse-cdn.com/v4/letter/c/c68b51/32.png) [@cattledogit](https://discourse.mozilla.org/u/cattledogit)\
**Post date:** [August 29, 2018, 3:15am UTC](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/32 "2018-08-29T03:15:04Z")

</div>

“YouTube mp3 Downloader” from author “YouTube Download Tool” appears to be the source of the malicious popup since it hasn’t appeared since I disabled that extension.

[Previous page](https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309.md?page=1)