⚠ Risky-Tool Advisory Analyzed reported to the Chrome Web Store · 2026-07-08
A security-hygiene observation, not a malware finding. This advisory documents dangerous security practices in a legitimate-purpose tool — for example transmitting credentials over plaintext HTTP, heavy code obfuscation, or automatic global installs. It is not a claim of theft, backdoor or malicious intent: the tool does what it advertises, and the risk falls on its own users and their data. It is published so operators can make an informed decision before installing or deploying it.
Advisory · CLR-2026-2997

A Chrome extension that strips Kling’s security headers to farm the AI service

The Chrome extension AutoKling ("Auto Send Prompts & Batch Download" for Kling) is a convenience automation tool for the Kling AI video/image service — a direct sibling of AutoHailuo (CLR-2026-2996) from the same "autojourney" family. To do its job it uses declarativeNetRequest to remove Kling’s Content-Security-Policy, X-Frame-Options, COOP and COEP response headers on klingai.com / kling.ai, then drives the service programmatically and batch-downloads its outputs. Stripping a site’s security headers and automating it at scale is abuse of the third-party service, not a supply-chain attack on the installer. We classify it as Abuse tooling and reported it to the Chrome Web Store.

HighRisky toolSecurity-header strippingAuto-* family (autojourney)Not a supply-chain attackReported to Chrome Web Store
Summary

AutoKling is a Chrome extension (id bloljhdbpajpebgkmdbjcmmnnljaknjg, v1.0.6.0) marketed as a productivity helper for the Kling AI service — it bulk-sends prompts and batch-downloads outputs. It is a sibling of AutoHailuo (CLR-2026-2996) in the same autojourney Auto-* family, cross-promoted from inside its own shared bundle (which also carries handlers for Kling, Poe, Sora, Grok and Google’s media endpoints).

To automate Kling’s own site it ships a declarativeNetRequest rule that removes four response security headers — Content-Security-Policy, X-Frame-Options, Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy — with condition.requestDomains = [klingai.com, kling.ai] on main and sub frames. Removing CSP and framing protections lets the extension embed and script the target site freely; it also weakens the user’s security posture on Kling while the extension is installed.

Its permissions are minimal and scoped: downloads, declarativeNetRequest, storage, notifications, with host_permissions and content scripts confined to klingai.com / kling.ai. It holds no cookies permission and no .

Why this is Abuse, not Malware — and what it does NOT do

We verified the boundaries carefully, because two scanner flags over-read on this extension. Our own extension scanner raised exfil-to-foreign-host and remote-code — and we confirmed both are false positives. The "foreign hosts" it contacts (assets.grok.com, sora.chatgpt.com, labs.google/fx/api, and Kling’s own endpoints) are the AI services’ own media/CDN URLs the tool downloads generated images and videos from — not exfiltration of the user’s data. The "remote code" is the extension injecting its own packaged scripts via chrome.runtime.getURL("scripts/…") into the page — a local resource, not code fetched from a third party.

AutoKling does not attack the person who installs it: with no cookies permission and host access confined to Kling, it cannot read the sessions of other sites. What leaves the browser is prompt text and downloaded media — not stolen credentials. It is therefore not a credential stealer or spyware, and it is out of scope for OSV / ossf-malicious-packages.

It is, however, abuse tooling aimed at a third party: it deliberately strips Kling’s security headers and automates Kling’s service at scale — behaviour that violates the target service’s terms and degrades the security guarantees Kling ships to its own users. Distributing a browser extension that neuters a site’s CSP/framing protections to farm it is a Chrome Web Store acceptable-use / abuse matter — and, with AutoHailuo, evidence of a family of such tools.

Indicators & characteristics
EXTAutoKling — Chrome Web Store id bloljhdbpajpebgkmdbjcmmnnljaknjg, v1.0.6.0
DNRdeclarativeNetRequest rules.json: modifyHeaders → remove Content-Security-Policy, X-Frame-Options, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy · condition.requestDomains = klingai.com, kling.ai (main_frame, sub_frame)
PERMpermissions: downloads, declarativeNetRequest, storage, notifications · host_permissions + content_scripts scoped to klingai.com / kling.ai only · NO cookies, NO
FAMILYautojourney Auto-* family (sibling of AutoHailuo CLR-2026-2996); bundle carries handlers/cross-promo for Kling, Poe, Sora, Grok, Google — cross-links sibling Web Store ids
FPOver-calls verified false: exfil-to-foreign-host = downloads of the AI services’ OWN media (assets.grok.com, sora.chatgpt.com, labs.google/fx); remote-code = chrome.runtime.getURL local bundled scripts (scripts/poe.js, ops.js, main.js)
SCOPENOT observed: cross-origin cookie/session theft, chrome.cookies use, or credential exfiltration — capability confined to Kling
Response & guidance
#ActionPriority
01 Installing it does not expose your other sites’ sessions or credentials. The security downgrade is confined to klingai.com / kling.ai — while installed, those sites run without their CSP / framing protections in your browser. Remove the extension if you don’t want that. Info
02 Enterprise / managed Chrome: consider block-listing the extension id — an extension that strips a site’s Content-Security-Policy and framing headers has no place in a managed fleet. The autojourney Auto-* family shares this pattern; block by signature, not one id. Recommended
03 Service operators (Kling & similar): the pattern — an extension that removes your CSP/XFO/COOP to embed and drive your app — now spans a family (Hailuo, Kling, …). The shared bundle + DNR header-strip is a useful abuse signature to watch for. Recommended
04 Reported to the Chrome Web Store for acceptable-use / abuse review. This class is out of scope for OSV / ossf-malicious-packages (no attack on the installer); the store abuse channel is the correct route. Done

Classified independently by codelake Research · AI-assisted triage + deterministic structural analysis of the packed CRX (manifest, declarativeNetRequest rules, request destinations, injected scripts). We explicitly verified that the scanner’s exfil-to-foreign-host and remote-code flags were false positives (vendor-owned media downloads; local getURL scripts) and that there is no cross-origin credential access, before publishing. Reported to the Chrome Web Store for abuse review.

This is an abuse-tooling advisory, not a supply-chain-malware one: AutoKling does not attack the user who installs it. No working payload or reproduction is published — the behaviour is described from structural analysis. The original artifact is preserved in the codelake archive and available to verified security researchers on request.