Skip to content

v0.3

Latest
Latest

Choose a tag to compare

View all tags
@orangefren orangefren released this 31 Aug 11:09
v0.3
15cef0d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OrangeFren Plugin v0.3 — August 31, 2026

Rewritten detection engine and a hardened security architecture. This version
continues the same extension identity as v0.1/v0.2 (signed with the same key).

What's new

Added

  • Full-page warning interstitial for known scams. Confirmed phishing sites
    (score 2) are now stopped by a dedicated extension page (warning.html)
    that the phishing site cannot remove, hide, or interact with — instead of an
    in-page overlay the site could potentially defeat.
  • Suspicious-domain overlay re-attachment. If the page removes the warning
    overlay from the DOM, the extension detects it and puts it back.
  • Punycode / homoglyph awareness. Hostnames are now compared in both ASCII
    (xn--) and Unicode forms to catch confusable-character attacks
    (e.g. Cyrillic or Greek look-alikes in look-similar domains).
  • Stricter phishing-feed validation. Every entry from the
    orangefren.com/api/get_phishing_data feed is schema-checked (version,
    known_legit list, HTTPS-only links) before it is stored. A malformed feed
    is rejected outright instead of corrupting protection data.
  • Build pipeline. build.js now bundles with esbuild (no more raw ES
    module imports in shipped content scripts — fixes "Cannot use import
    statement outside a module"), copies static assets, and supports CRX
    packaging via --pack.

Changed

  • Known-scam matching is now exact. v0.2 matched known_scams with
    substring includes(), which could flag unrelated hosts containing a scam
    string; v0.3 matches only the exact host or its subdomains.
  • "Always suppress" moved out of page DOM. The "always suppress warnings
    on this domain" choice is now preserved in extension-controlled storage
    with validated, normalized entries (it previously lived on buttons any page
    script could click), and suppress entries survive feed refreshes by keying
    on the site name.
  • Hourly feed refresh is now reliable. The alarm is re-armed on browser
    startup and every service-worker wake-up, not only on first install.
  • Removed the 1-second setInterval URL poller in favor of event-driven
    navigation detection.

Fixed

  • Broken emoji in warnings (mojibake characters) — warning text is now
    built with text nodes instead of innerHTML with broken encoding.
  • Untrusted-input handling. All URL parameters passed to the interstitial
    page are rendered with textContent only; the "go to real site" link
    accepts https: URLs exclusively.
  • Button spam / fake-click protection. Warnings now only respond to
    trusted user gestures (e.isTrusted), so pages cannot programmatically
    click "proceed" or "suppress" on the user's behalf.
  • Extension-reload edge case: an orphaned content script now stops retrying
    cleanly instead of throwing repeated errors after the extension updates.

Internal

  • Chrome extension (MV3) — no new permissions compared to v0.2
    (alarms, storage, all-URLs host access for on-page checks).
  • Signed with the same CRX key as v0.1/v0.2 — installs as an in-place update.

Installation

You need one of the two files from this release:

  • OrangeFren-Plugin-v0.3.crx — signed package (same extension ID as v0.1/v0.2)
  • OrangeFren-Plugin-v0.3.zip — unpacked build (for sideloading or code review)

Option A — Install from the ZIP (Chromium browsers: Chrome, Brave, Edge, Opera)

  1. Download and unzip OrangeFren-Plugin-v0.3.zip to a permanent folder
    (you can delete it later only if you also remove the extension — the browser
    loads the files from this location on every start).
  2. Open the extensions page:
    • Chrome / Brave / Edge: chrome://extensions / brave://extensions / edge://extensions
    • Or menu → Extensions → Manage Extensions.
  3. Enable Developer mode (top-right toggle).
  4. Click Load unpacked and select the unzipped folder — the one that
    directly contains manifest.json (not the ZIP itself, and not its
    parent folder).
  5. Pin "OrangeFren Plugin" from the puzzle-piece menu if you want quick access.

That's it — the plugin fetches its phishing-domain list from
orangefren.com on install and refreshes it hourly. No configuration needed.

Option B — Install from the CRX (signed package)

How a .crx file installs depends on your browser and platform:

  • Chromium on Linux — accepts local .crx installs:
    open chrome://extensions with Developer mode on, then drag the
    .crx file onto the page.
  • Chrome / Brave on Windows/macOS — drag-and-drop of local .crx files is
    disabled for security ("This extension is not listed in the Chrome Web Store
    and may have been added without your knowledge"). Use Option A instead,
    or host the .crx and install it via enterprise policy
    (ExtensionInstallSources / ExtensionSettings).
  • Checking the signature (optional) — the package is signed with the same
    key as v0.1/v0.2, so it installs as an update (same extension ID), keeping
    your settings.

Updating from v0.1 / v0.2

  • Zip install: remove the old unpacked extension in chrome://extensions,
    then load the new unzipped folder (Option A).
  • If the old version was installed from the .crx, installing the new
    .crx over it keeps the extension ID and stored settings.

Verifying the download

SHA-256 checksums:

a11343b5b3f2a5e9235b07717f2dc0df8e6a8aaab0e5c52a928dceb7005ce0b6  OrangeFren-Plugin-v0.3.crx
a81410ef9c699259395c6fe697edde5c527e8ce5646177ca23639f3489a9719d  OrangeFren-Plugin-v0.3.zip

Windows (PowerShell): Get-FileHash .\OrangeFren-Plugin-v0.3.crx
Linux/macOS: sha256sum OrangeFren-Plugin-v0.3.crx

Permissions — why it asks for them

  • Read and change all websites: the plugin must inspect the hostname of
    every site you open to compare it against its phishing-domain list. All
    matching happens locally in your browser; the only network request is one
    hourly GET to orangefren.com/api/get_phishing_data to refresh the list.
  • Storage: keeps the phishing-domain list and your "suppress warning"
    choices locally.
  • Alarms: powers the hourly list refresh.

Previous version — v0.2 (February 13, 2025)

  • Hourly phishing-feed updates from orangefren.com.
  • In-page overlay warning with "go to the real site" / "proceed anyway" /
    "always suppress on this domain" actions.
  • Heuristic detection: look-alike characters, prefix/suffix patterns
    (secure., -login), and same-name-different-TLD matches.
Assets 4
Loading