| 1 | Network Interception | critical | lib/easyadblock.js (line 3410) | The extension registers `webRequest` and `webRequestBlocking` listeners covering all URLs (`http://*/*`, `https://*/*`) with the `blocking` flag, meaning it can intercept, inspect, and modify every network request mad… | |
| 2 | Privilege Escalation | critical | ext/background.js (line 52) | The injected GTM script runs in the extension background page context, meaning it inherits all of the extension's declared permissions: tabs, webRequest, webRequestBlocking, webNavigation, storage, and <all_urls>. The… | |
| 3 | Remote Code Loading | critical | ext/background.js (line 52) | The background page dynamically injects a Google Tag Manager script tag (container GTM-N9R5WDB) into its own privileged DOM, loading arbitrary remote JavaScript at runtime from googletagmanager.com. GTM containers can… | |
| 4 | Remote Code Loading | critical | lib/easyadblock.js (line 820) | The extension auto-subscribes to filter lists hosted on `rules.easyadblocker.com`, a third-party domain that is not the legitimate AdblockPlus infrastructure. These remotely-hosted filter lists can be modified at any … | |
| 5 | Code Injection | high | include.preload.js (line 1469) | The extension calls contentWindow.eval() to serialize and evaluate a function string inside cross-origin iframe content windows. This injects arbitrary JavaScript across frame boundaries into the context of any embedd… | |
| 6 | Code Injection | high | include.preload.js (line 1734) | The extension dynamically serializes a function into a Blob URL and injects it as a script element into every page's DOM on every site the user visits. The injected code runs in the page's principal origin context, by… | |
| 7 | Code Injection | high | include.preload.js (line 1469) | The extension calls `contentWindow.eval()` to inject a dynamically-constructed code string into every iframe, frame, and object element across all pages. This is a code injection technique: the `injectedToString()` fu… | |
| 8 | Network Interception | high | ext/background.js (line 173) | A webRequest.onHeadersReceived listener reads response headers for every main and sub frame across all HTTP/HTTPS URLs. Combined with the GTM remote code injection in the same file, any code the GTM container owner pu… | |
| 9 | Network Interception | high | lib/easyadblock.js (line 9938) | The extension intercepts HTTP response headers for all pages and injects or overrides Content-Security-Policy headers based on remotely-controlled filter rules from easyadblocker.com. Since the operator fully controls… | |
| 10 | Remote Code Loading | high | lib/easyadblock.js (line 820) | All filter subscription and notification URLs point to operator-controlled third-party domains (rules.easyadblocker.com, cdn.easyadblocker.com) rather than the original Adblock Plus infrastructure. This means the oper… | |
| 11 | Tracking | high | ext/background.js (line 52) | The GTM container ID GTM-N9R5WDB allows the container owner to deploy tracking pixels, analytics beacons, and audience segmentation tags that transmit browsing behavior, page URLs, and user identifiers to third-party … | |
| 12 | Network Interception | medium | include.preload.js (line 1443) | A covert inter-context communication channel uses randomly-named DOM custom events to relay URLs from injected page-context code to the extension background, forwarding every URL passed to RTCPeerConnection constructo… | |
| 13 | Network Interception | medium | include.preload.js (line 1577) | The injected page-context script replaces the native RTCPeerConnection and webkitRTCPeerConnection constructors on every page with a wrapped version that intercepts all WebRTC connection setup calls. All ICE server UR… | |
| 14 | Other | medium | common.js (line 44) | The checkShareResource function always reports docDomain as "easyadblocker.com" regardless of the actual originating page when querying the extension's filter engine. This artificially makes all URL checks appear to o… | |
| 15 | Phishing | medium | lib/easyadblock.js (line 5016) | Downloaded notification JSON from cdn.easyadblocker.com is parsed and stored into extension preferences with no content validation beyond basic JSON structure. This remotely-controlled notification channel can deliver… | |
| 16 | Unauthorized Data Collection | medium | lib/easyadblock.js (line 816) | When a filter subscription download fails, the extension sends detailed diagnostic telemetry—including the subscription URL, download URL, error codes, channel status, and HTTP response codes—to adblockplus.org. This … | |
| 17 | Unauthorized Data Collection | medium | lib/easyadblock.js (line 816) | When subscription downloads fail after a threshold of errors, the extension sends an outbound GET request to `adblockplus.org` containing the subscription URL, download URL, error code, channel status, and response st… | |
| 18 | Code Injection | low | popup.js (line 110) | The popup assigns values received from runtime messages directly to innerHTML without sanitization. If the background page (which runs GTM-injected remote code) sends a non-numeric value, arbitrary HTML including scri… | |
| 19 | Other | low | common.js (line 44) | The `common.js` shared UI file hardcodes `easyadblocker.com` as the `docDomain` when checking whether share resources are blocked. This tight coupling between the extension UI and an operator-controlled domain means t… | |
