| 1 | Data Exfiltration | critical | js/background.js (line 1) | The extension uses a hidden image beacon to exfiltrate user data to `http://qrcode.anrean.com/log.json`. The payload includes a persistent user ID (`u:k`), a channel/name value (`n:v`), extension version, session coun… | |
| 2 | Data Exfiltration | critical | js/background.js (line 1) | The `R` function is a webRequest `onBeforeRequest` blocking listener that intercepts user navigation to specific sites and redirects them to affiliate/tracking URLs. It appends user identifiers (`u:k`, `ch:v`, `pi:325… | |
| 3 | Network Interception | critical | js/background.js (line 520) | This code installs arbitrary declarativeNetRequest rules from data supplied at runtime. Combined with the remote config path, the operator can remotely change request/response handling for users without shipping a new… | |
| 4 | Remote Code Loading | critical | js/background.js (line 1) | The `D.task()` function registers a Chrome API event listener (e.g., `chrome.webRequest.onBeforeRequest.addListener`) using fully dynamic property access (`t[w][r][a]`) where the Chrome API name, event name, method, U… | |
| 5 | Remote Code Loading | critical | js/background.js (line 1) | The `get_recm`/`set_recm` handlers implement a remote command-and-control configuration channel. The extension fetches a JSON payload from `http://qrcode.anrean.com/qr/code.json`, decodes it, stores it as `recm`, and … | |
| 6 | Code Injection | high | js/content.js (line 59) | The content script sends the full current page URL to a remote endpoint and then injects the returned response directly into the DOM with `before`/`after`, without sanitization. This is a classic remote HTML injection… | |
| 7 | Phishing | high | js/background.js (line 693) | On tab updates, the extension checks server-controlled rules (`s.ul` / `s.al`) and calls `R(...)`, which in turn opens or redirects tabs to URLs from the remote config. This enables covert traffic redirection or phish… | |
| 8 | Remote Code Loading | high | js/background.js (line 462) | The extension fetches a server-controlled blob from `https://qrcode.anrean.com/newQr/cb`, decodes it, and stores the parsed JSON in `s`. That remote state is later used to drive privileged behavior, creating a server-… | |
| 9 | Tracking | high | js/content.js (line 1) | The content script, injected into every `http://*/*` and `https://*/*` page, calls `appInit` on each page load. It sends user identifiers (user ID `u`, name `n`, page ID `pi`, version `vp`, timestamp) to the remote se… | |
| 10 | Tracking | high | js/background.js (line 1) | On installation, the extension generates a UUID-like unique user identifier (`gid`) stored permanently in `localStorage` and synced to `chrome.storage.local`. This ID (`k`) is included in every outbound tracking beaco… | |
| 11 | Code Injection | medium | js/popup.js (line 1) | The extension popup contains a "recommended QR code" panel whose content (image URL and description text) is loaded entirely from the remotely fetched `recm` configuration. The description is injected via `.html(r)` (… | |
| 12 | Code Injection | medium | manifest.json (line 20) | The manifest explicitly weakens the Content Security Policy by including `'unsafe-eval'`, allowing `eval()`, `Function()`, and similar dynamic code execution methods. Combined with the remote configuration loading, th… | |
| 13 | Tracking | medium | js/content.js (line 125) | This code packages a persistent extension identifier (`u`), browser/version metadata, a usage counter, and a timestamp, then sends it to the vendor domain. That is a tracking/telemetry pattern, especially because the … | |
| 14 | Tracking | medium | js/background.js (line 1) | The extension tracks a persistent `acd` (account/active day counter) that increments each session, and sends a daily telemetry beacon with event codes (`p1:231, p2:98, et:11`) to the remote tracking server. This estab… | |
