Chrome Process shelljacket

Question

noticed today this process running on google chrome task manager referencing http://shelljacket.us

If I closed it will restart automatically in a few seconds.

Can anyone confirm if this is safe? How can I get rid of it?

Answer 1

Your Task Manager is showing "Subestrutura: http://shelljacket.us. This is Portuguese for "Subframe: http://shelljacket.us", and means that Site isolation is enabled in your Chrome browser. Google's help page on this feature suggests that you can toggle Site isolation via chrome://flags/#enable-site-per-process

Even when you did not enable site isolation, then site isolation will still be used for websites loaded inside a Chrome extension. In your process list, I see that the item immediately above your unwanted process is an extension. To get rid of the frame, you can try to disable the extension.

Seeing an unknown site in a separate process in itself is not something to worry about. But this site in question seems to only contain a tracker from QuantCast, which I consider suspicious from the privacy perspective.

I looked up the extension in the Chrome Web Store ("Hotspot Shield Elite VPN Proxy") and used my Extension Source Viewer to read the source code of the extension. I found a code snippet in the extension's background script that confirms that the extension is embedding an frame with a QuantCast URL.

        }, {
            key: 'quantcast',
            value: function quantcast() {
                if (!sdk.config.reporting.quantcast) return;
                var iFrame = document.createElement("IFRAME");
                iFrame.setAttribute("src", sdk.config.reporting.quantcast.url + '?rand=' + Date.now());
                iFrame.style.width = 0 + "px";
                iFrame.style.height = 0 + "px";
                iFrame.style.display = "none";
                document.body.appendChild(iFrame);
            }
        }, {

If you are using that VPN extension for privacy purposes, I would recommend you to immediately uninstall it, because this is clearly a sign that your privacy is violated.