| 1 | Obfuscation | critical | js/background.js (line 4) | This scriptlet reads a value from the `window.ysmm` property (associated with the Adfly ad network), applies a custom XOR-based character rearrangement to deobfuscate it, then base64-decodes the result via `atob()` an… | |
| 2 | Code Injection | high | js/content.js (line 697) | The content script hooks frame accessors and uses `eval` to inject code into page and iframe execution contexts. This is a powerful code-injection pattern that runs on every matched site at `document_start`, increasin… | |
| 3 | Credential Theft | high | js/background.js (line 4) | A scriptlet reads the full `document.cookie` string on every visited page to identify and delete cookies matching a regex pattern, by writing expired cookie headers with multiple domain/path prefix combinations. While… | |
| 4 | Data Exfiltration | high | js/background.js (line 4) | The `sendUrlReport` function POSTs the full URL of pages the user visits to a remote `reportUrl` endpoint via XMLHttpRequest, along with a message type and optional comment. This directly exfiltrates specific browsing… | |
| 5 | Other | high | js/background.js (line 2926) | On startup, the extension downloads an external whitelist from a remote server and merges it into the local whitelist. Because the URL uses plain HTTP, a network attacker could tamper with this response, and the serve… | |
| 6 | Tracking | high | js/background.js (line 4) | The extension generates a persistent UUID client ID stored in chrome.storage.local and sends it along with the extension's runtime ID to Google Analytics under tracking ID UA-212388634-1 on every background page load.… | |
| 7 | Tracking | high | js/background.js (line 4) | The extension generates a persistent UUID ('cid') stored in chrome.storage.local on first run and sends it to Google Analytics (property UA-212388634-1) via a POST request on every background page load. The payload in… | |
| 8 | Unauthorized Data Collection | high | js/background.js (line 4) | The analytics module is explicitly invoked with tracking ID UA-212388634-1 immediately when the background service worker starts. This ID does not correspond to any known AdGuard/AdTidy Google Analytics property and a… | |
| 9 | Unauthorized Data Collection | high | js/background.js (line 4) | The CB() function monkey-patches both `window.eval` and `window.Function` in the page context with intercepting wrappers that invoke an external callback (hF) logging every invocation before delegating to the original… | |
| 10 | Unauthorized Data Collection | high | js/background.js (line 4) | The extension calls its analytics tracker with the Google Analytics property UA-212388634-1 immediately on startup. The extension presents itself as 'Adblock Dragon' but embeds AdGuard's entire filter engine (adblocke… | |
| 11 | Unauthorized Data Collection | high | js/background.js (line 4) | A hardcoded API key ('4DDBE80A3DA94D819A00523252FB6380') is embedded and appended to all requests to chrome.adtidy.org including filter update and rule-stats endpoints. The extension also POSTs filter hit statistics (… | |
| 12 | Code Injection | medium | js/content.js (line 1) | The content script hooks the contentWindow and contentDocument property getters on HTMLIFrameElement prototypes to intercept every iframe access, then calls eval() on each new iframe's window object to inject the page… | |
| 13 | Network Interception | medium | js/background.js (line 4) | A blocking `webRequest.onBeforeRequest` listener is registered against extension-internal URLs that rewrites request query strings with a secret token, canceling unauthorized accesses. While this is nominally a resour… | |
| 14 | Tracking | medium | js/background.js (line 2876) | The extension generates and persists a unique client ID in `chrome.storage.local`, then sends it to Google Analytics. This creates a durable identifier for the extension installation and enables usage tracking without… | |
| 15 | Unauthorized Data Collection | medium | js/background.js (line 52148) | This handler records per-request context and explicitly parses both outbound `Cookie` headers and inbound `Set-Cookie` headers. For an extension with `<all_urls>` and `webRequest` access, this gives visibility into au… | |
| 16 | Unauthorized Data Collection | medium | js/background.js (line 4) | The `sendHitStats` function POSTs filter rule hit statistics — including browser fingerprint, extension version, and which filter list rules triggered per domain — to a remote `ruleStatsUrl` endpoint. Which rules fire… | |
| 17 | Unauthorized Data Collection | medium | js/content.js (line 1) | The content script, injected into every page including about:blank frames at document_start, polls document.cookie every 1,000ms across all sites and fires onRuleAppliedCallback with the full cookie name, value, domai… | |
