| 1 | Code Injection | critical | js/content.js (line 1) | The content script hooks HTMLIFrameElement.prototype.contentWindow and contentDocument getters to intercept every iframe access on the page. When a frame's window object is accessed, a serialized function is injected โฆ | |
| 2 | Code Injection | critical | js/content.js (line 1) | The extension hooks the native `contentWindow` and `contentDocument` property getters on HTMLFrameElement, HTMLIFrameElement, and HTMLObjectElement to intercept every iframe access. Whenever a frame's window is accessโฆ | |
| 3 | Code Injection | critical | js/content.js (line 1) | The content script listens for `injectScripts` messages from the background page and dynamically creates a `<script>` element with the provided code payload, appending it directly to `document.head` on every visited pโฆ | |
| 4 | Remote Code Loading | critical | js/background.js (line 1) | On initialization, the extension fetches a remote whitelist from an AWS S3 bucket over unencrypted HTTP, incorporating the extension's own runtime ID in the URL path. The fetched domain list is injected directly into โฆ | |
| 5 | Unauthorized Data Collection | critical | js/background.js (line 4) | The extension silently beacons to Google Analytics on every background page load using tracking ID UA-211081916-1, which does not belong to AdGuard (the upstream codebase). A persistent UUID is generated via uuid.v4()โฆ | |
| 6 | Credential Theft | high | js/content.js (line 1) | The content script establishes a persistent setInterval polling loop every 1 second that reads document.cookie on every visited page and fires a callback whenever the cookie string changes. This continuous cookie survโฆ | |
| 7 | Credential Theft | high | js/content.js (line 1) | The `CookieController` monitors `document.cookie` and on every cookie change extracts the full cookie name and value, along with the domain, and sends them as a `SAVE_COOKIE_LOG_EVENT` to the background page. Transmitโฆ | |
| 8 | Data Exfiltration | high | js/background.js (line 4) | The extension POSTs full URLs visited by the user to `https://chrome.adtidy.org/url-report.html`. The URL is sent alongside a message type and optional comment, meaning the developer's backend can receive arbitrary URโฆ | |
| 9 | Obfuscation | high | js/background.js (line 1) | A scriptlet intercepts the window.ysmm property setter via Object.defineProperty. When set, the value is decoded through a custom XOR-based character interleaving routine followed by window.atob() base64 decoding, andโฆ | |
| 10 | Privilege Escalation | high | js/background.js (line 1) | On extension install, the background script programmatically injects content.js into every currently open tab across all frames via tabs.executeScript. This aggressive injection into all existing tabs โ not just futurโฆ | |
| 11 | Privilege Escalation | high | js/background.js (line 4) | On installation, the extension immediately executes a content script (`js/content.js`) into all currently open tabs across all frames without any user interaction. This grants the extension immediate code execution coโฆ | |
| 12 | Tracking | high | js/background.js (line 1) | The extension generates and persists a stable UUID client ID via chrome.storage.local, then silently fires a Google Analytics pageview beacon to https://www.google-analytics.com/collect on every background page load, โฆ | |
| 13 | Tracking | high | js/background.js (line 4) | The extension generates or retrieves a persistent unique client ID (UUID) stored in local storage and sends it along with the extension's runtime ID to Google Analytics (UA-211081916-1) as a pageview hit on every backโฆ | |
| 14 | Tracking | high | js/background.js (line 4) | A second per-install identifier (8 random chars + timestamp) is generated and stored in localStorage under 'client-id'. This ID is appended as a 'cid' query parameter to every filter metadata and filter-list request sโฆ | |
| 15 | Unauthorized Data Collection | high | js/content.js (line 1) | The `listenCookieChange` method polls `document.cookie` every 1000ms on every visited page, capturing the full cookie string whenever it changes. Combined with the `SAVE_COOKIE_LOG_EVENT` handler, this creates a persiโฆ | |
| 16 | Code Injection | medium | js/background.js (line 1) | A scriptlet replaces window.eval and window.Function with proxy wrappers that log every eval/Function invocation before delegating to the originals. This hooks the page's core dynamic code execution primitives on all โฆ | |
| 17 | Code Injection | medium | js/background.js (line 4) | On first install, the extension programmatically injects its content script (content.js, ~90KB) into every tab open in the browser at the time, including all frames, without any page reload or user action. While ad blโฆ | |
| 18 | Credential Theft | medium | js/background.js (line 1) | A scriptlet reads all cookies via document.cookie, matches them against a regex pattern, and systematically deletes them by setting expiry to epoch across every domain/path combination. It runs on page load and again โฆ | |
| 19 | Data Exfiltration | medium | js/background.js (line 4) | Filter hit statistics (which rules fired and how many times) and URLs visited by the user (via url-report) are periodically POSTed to chrome.adtidy.org. The rule stats reveal browsing patterns (which ad networks the uโฆ | |
| 20 | Obfuscation | medium | js/popup.js (line 1) | The entire popup.js is a single minified line using a custom module loader with pervasively obfuscated single-character variable names (mK, jr, Jg, kX, Mu, xB, Co, Gg, FI, iM) throughout. This obfuscation makes staticโฆ | |
| 21 | Obfuscation | medium | js/popup.js (line 1) | The entire popup.js is a single-line heavily minified/obfuscated bundle using a custom browserify-style module loader with single-character variable names throughout. All identifiers have been renamed to short meaningโฆ | |
| 22 | Other | medium | js/background.js (line 4) | A hardcoded API key (`4DDBE80A3DA94D819A00523252FB6380`) is embedded in the extension bundle and appended to all outgoing requests to AdGuard's backend infrastructure (`chrome.adtidy.org`). "Alfablocker" is not an offโฆ | |
| 23 | Tracking | medium | js/content.js (line 1) | On every page load, the content script sends `window.location.href` (the full URL) to the background via `GET_SELECTORS_AND_SCRIPTS`, which responds with selectors and scripts to inject โ meaning the background receivโฆ | |
| 24 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension transmits filter rule hit statistics โ including rule IDs, filter versions, browser type, and extension version โ to https://chrome.adtidy.org/rulestats.html via XHR POST. The complete set of matched rulโฆ | |
| 25 | Unauthorized Data Collection | medium | js/background.js (line 4) | The extension POSTs filter rule hit statistics (which ad-blocking rules fired, extension version, browser type) to `https://chrome.adtidy.org/rulestats.html` without explicit user consent. Combined with the persistentโฆ | |
| 26 | Obfuscation | low | js/background.js (line 4) | This scriptlet intercepts the 'ysmm' property (used by the AdFly ad-redirect service) via Object.defineProperty, decodes a base64+XOR-obfuscated URL using atob(), strips 16-byte prefix/suffix padding, then forcibly reโฆ | |
