ScamShield 0.5.0

ScamShield 0.5.0

Install: Chrome Web Store (Chrome/Edge/Brave/Opera — 0.5.0 is submitted and awaiting review; the store serves 0.3.1 until it clears) · Firefox 128+: download scamshield-firefox.zip below and load it via about:debugging → Load Temporary Add-on (AMO listing pending).

Assets: scamshield-chrome.zip / scamshield-firefox.zip are the exact packages built from this tag by npm run build (~170 KB each). No new permissions since 0.3.1 — a drop-in update.

What changed since the 0.3.1 store version

• Page analysis — an on-device model now reads the page's wording, layout
  and form structure (not just the address) to catch brand-new phishing pages
  a URL-only check would miss. Trained on a 375-positive / 2,542-negative live
  crawl (holdout AUC 0.886). Conservative by design: on its own, content
  analysis only ever raises a yellow "suspicious" banner — it takes a second,
  corroborating signal to turn a page red.
• Brand look-alike detection by icon — favicons/logos are hash-matched
  against a 64-brand table (49 with icon hashes), including UAE banks, telcos and
  government services: Emirates NBD, ADCB, FAB, Mashreq, RAKBANK, e&, du,
  Noon, Aramex, Talabat, Careem, ADNOC, DEWA, ICP, MOHRE, Dubai Police, UAE
  PASS, Emirates, Etihad — plus PayPal, Microsoft, Google, Apple, DHL and
  more. A page using a brand's icon with a password form on the wrong domain
  is flagged, even if the brand's name never appears anywhere on the page.
  The favicon-hotlink loophole (serving the real brand's icon file directly)
  is closed.
• Real threat feed, on by default — a daily-rebuilt list (OpenPhish +
  URLhaus, false-positive filtered) with a bundled snapshot; Settings show
  last-updated time and rule count.
• Scam message checker — paste any SMS/WhatsApp/email text or link into
  the popup for an instant on-device verdict.
• Protection history and a one-click "Take me to the real site"
  rescue button on brand-impersonation warnings.
• Redesigned popup and settings — a single status card with one clear
  action (Leave this page / Show why), plain-language reasons, Trust
  this site for 1 hour / until tomorrow / always, Report a mistake, stats
  and recent history, dark mode, and explained toggles throughout Settings.
• Smaller and faster — about 0.6 MB unpacked / ~170 KB zipped, down from
  14 MB: the ONNX runtime is gone. Both models now run as plain JS, with no
  WebAssembly and no web-accessible resources.
• Optional community reporting, off by default — "Help make ScamShield
  smarter" sends only the site's host name and anonymous risk signals, and
  only for pages flagged dangerous or that you report as a mistake. Never
  URLs, page text, or anything that identifies you. Not sold, and not used
  for anything other than improving detection accuracy.
• URL model retrained as gradient-boosted trees running as pure JS,
  with deep-link negatives added to fix a path-length bias (accuracy 0.988,
  ROC-AUC 0.998).
• No new permissions. Settings, trusted sites and history from 0.3.1
  carry over unchanged; the update is a drop-in.

Full detail: CHANGELOG.md · Privacy policy · Threat feed