| 1 | Code Injection | high | js/other-content-chrome.js (line 5366) | Dynamically constructs a <script> element with arbitrary JS source set via innerHTML and inserts it into the page DOM, executing the code in the page's main-world JavaScript context. This is a CSP-bypass-style escape … | |
| 2 | Privilege Escalation | high | js/insert-script-content-chrome.js (line 2037) | Implements a full remote-controlled browser automation agent ("galactus") that exposes commands like GoTo, ClickOnElement, FillInputElement, FormSubmit, ScrollToElement, SetAttribute, SetCheckboxElement, SelectOptionE… | |
| 3 | Privilege Escalation | high | js/other-content-chrome.js (line 5138) | A large inlined string `ne` is a self-contained "agent" that, once injected into a page, exposes capabilities to fill arbitrary input fields (including type=password), click and scroll to elements, navigate/reload, re… | |
| 4 | Remote Code Loading | high | js/other-content-chrome.js (line 5206) | Per-domain automation 'flowScript' programs are fetched at runtime from apc-dcs.figleafapp.com and decoded as JWTs, then executed by the in-page agent (filling forms, clicking, navigating, snapshotting). Although a ba… | |
| 5 | Code Injection | medium | js/insert-script-content-chrome.js (line 764) | A multi-kilobyte string ("Galactus agent") is injected into the page's MAIN world via documentElement.insertBefore of a <script> tag. It defines window.createAgent() exposing a wide DOM-control RPC: GetInputValue, Fil… | |
| 6 | Code Injection | medium | js/insert-script-content-chrome.js (line 921) | Helper that synthesizes a <script> whose innerHTML is a string-concatenated function body and stuffs it into the document, then polls a DOM element for the result. Equivalent to eval-in-page-context: the function sour… | |
| 7 | Code Injection | medium | js/insert-script-content-chrome.js (line 765) | A massive inline JavaScript blob is injected into the page's main world via a dynamically created <script> element (innerHTML + documentElement.insertBefore). The blob installs a 'createAgent' handler exposing high-pr… | |
| 8 | Code Injection | medium | js/insert-script-content-chrome.js (line 921) | Constructs JavaScript source as a string by stringifying a function and arguments, then injects it via `script.innerHTML` and inserts it into the live document so it executes in the page's MAIN world. This bypasses co… | |
| 9 | Code Injection | medium | js/intercept-captcha-iframe-chrome.js (line 919) | Constructs a <script> element whose innerHTML is a runtime-built JS string that calls a serialized closure with arbitrary JSON arguments, inserts it into document.documentElement to execute in the page's main world, t… | |
| 10 | Code Injection | medium | js/other-content-chrome.js (line 5275) | A multi-kilobyte minified JavaScript string is held inline as a string literal and later injected into target pages. It exposes a full main-world automation API (FillInputElement, ClickOnElement, FormSubmit, GetCaptch… | |
| 11 | Code Injection | medium | js/other-content-chrome.js (line 5274) | Helper `fe` (and the embedded 'createAgent' template at line 5142) injects dynamically-built JavaScript into the page's main-world by stringifying a function and assigning to `script.innerHTML`, then inserting the scr… | |
| 12 | Code Injection | medium | js/other-content-chrome.js (line 5274) | `fe()` constructs a <script> tag whose innerHTML is built by string-interpolating a stringified JS function and JSON-serialized arguments, then injects it into the page DOM (document.documentElement) so it runs in the… | |
| 13 | Code Injection | medium | js/insert-script-content-chrome.js (line 867) | The extension dynamically constructs a <script> element, assigns arbitrary JavaScript via innerHTML built from `e.toString()` of a function, and injects it into the page DOM to execute in the page's main world (bypass… | |
| 14 | Credential Theft | medium | js/other-content-chrome.js (line 6305) | GetInputValue / FillInputElement explicitly include input type="password" in their fillable/readable allowlist. The remote agent infrastructure can therefore both read and write password field values on any page where… | |
| 15 | Credential Theft | medium | js/specific-webpage-content-chrome.js (line 1067) | On any postMessage with type 'TO_EXTENSION' the script enumerates the entire page localStorage, picks the first entry whose JSON parses with an 'auth' field, extracts accessToken/refreshToken, and hands them to the ex… | |
| 16 | Credential Theft | medium | js/specific-webpage-content-chrome.js (line 1058) | On `*.aura.com` and `localhost`, the content script enumerates every value in `window.localStorage`, looks for one that JSON-parses to an object with an `auth` field, extracts `accessToken`/`refreshToken`, and forward… | |
| 17 | Data Exfiltration | medium | js/insert-script-content-chrome.js (line 1993) | The agent can capture full HTML snapshots of any page (`TakeSnapshot`) and ship them as Sentry-style envelope attachments with `content_type: text/plain` to a remote ingestion endpoint controlled by the vendor. Even t… | |
| 18 | Data Exfiltration | medium | js/other-content-chrome.js (line 6494) | On automation errors, a full serialized HTML snapshot of the user's current page (head+body, with attempted PII masking via regex replacement) is uploaded as a Sentry attachment to o745714.ingest.sentry.io. The maskin… | |
| 19 | Data Exfiltration | medium | js/other-content-chrome.js (line 6177) | On error, the extension uploads a serialized HTML `pageSnapshot` of the visited page (along with the full pageUrl, scriptDomain and operation metadata) to a Sentry-style endpoint as an attachment in the envelope POST.… | |
| 20 | Data Exfiltration | medium | js/insert-script-content-chrome.js (line 900) | `TakeSnapshot` clones the entire document body, applies a regex-based PII mask supplied by the remote job, serializes the head+body to an HTML string, and ships it back through retryAgentCall. The masking is regex-sub… | |
| 21 | Network Interception | medium | js/apa-inject-captcha-callback-content-chrome.js (line 2696) | The extension installs a session declarativeNetRequest rule that strips X-Frame-Options, Content-Security-Policy, and CSP-Report-Only response headers from sub_frame requests. The rule is scoped to TAB_ID_NONE (offscr… | |
| 22 | Network Interception | medium | js/apa-inject-captcha-callback-content-chrome.js (line 2401) | The script overrides the page's window.grecaptcha property with a getter/setter that wraps grecaptcha.execute (and grecaptcha.enterprise.execute), redirecting reCAPTCHA solve requests through the extension's own solve… | |
| 23 | Network Interception | medium | js/intercept-captcha-iframe-chrome.js (line 2810) | Runs in MAIN world at document_start on hcaptcha/recaptcha iframes and monkey-patches window.turnstile.render to siphon Cloudflare Turnstile sitekey, cData, chlPageData, action, page URL and User-Agent for a hardcoded… | |
| 24 | Network Interception | medium | js/insert-script-content-chrome.js (line 3700) | Extension contains a captcha-solving and execution-orchestration client that POSTs to automation.aurasvc.io with createCaptchaTask / getCaptchaTask / get_ephemeral_email_address endpoints, and a content_script (interc… | |
| 25 | Network Interception | medium | manifest.json (line 112) | A content script is registered to run in the MAIN world at document_start inside hCaptcha and reCAPTCHA iframes, pairing with the captcha-solving HTTP client (automation.aurasvc.io /executor/create_captcha_task) shipp… | |
| 26 | Other | medium | js/intercept-captcha-iframe-chrome.js (line 1423) | The extension installs content scripts on hCaptcha and reCAPTCHA iframes (manifest content_scripts entry) and contains code that programmatically fills the `h-captcha-response` / `g-recaptcha-response` and Cloudflare … | |
| 27 | Other | medium | js/insert-script-content-chrome.js (line 735) | The injected `createAgent` payload extracts hCaptcha/reCAPTCHA sitekeys and pageurl, ships them to a remote captcha-solving task service (createCaptchaTask/getCaptchaTask), then writes the returned token directly into… | |
| 28 | Privilege Escalation | medium | js/other-content-chrome.js (line 8354) | The all-frames `<all_urls>` content script automatically programmatically injects the heavyweight automation/agent script (`insert-script-content-chrome.js`) into every page the user visits and starts an iframe agent … | |
| 29 | Privilege Escalation | medium | js/insert-script-content-chrome.js (line 762) | A full page-automation agent is injected into pages exposing a remote-controlled API: navigate, click, fill input fields (including type=password per the allowed-types set), submit forms, take DOM snapshots, and resol… | |
| 30 | Privilege Escalation | medium | js/insert-script-content-chrome.js (line 1831) | The extension exposes a remote job-dispatch framework: it pulls 'jobs' from automation.aurasvc.io (and figleafapp.com endpoints elsewhere) and executes them as on-page automation in the user's browser. Each job can na… | |
| 31 | Privilege Escalation | medium | js/insert-script-content-chrome.js (line 735) | FillInputElement targets any input by remote-supplied XPath — including type="password" — and synthesizes a full focus/keydown/keyup/keypress/input/change/blur event sequence so framework state listeners (React's _val… | |
| 32 | Remote Code Loading | medium | js/insert-script-content-chrome.js (line 760) | Extension fetches per-domain 'flowScript' automation programs from a hardcoded backend (apc-dcs.figleafapp.com — Aura's legacy FigLeaf domain) and executes them as part of its Automatic Password Change (APC) flow. Scr… | |
| 33 | Remote Code Loading | medium | js/other-content-chrome.js (line 5226) | Content script (running on <all_urls>) fetches remote 'flowScript' configuration/code from the hard-coded server `https://apc-dcs.figleafapp.com` (the FigLeaf/Aura legacy domain set at line 5138) and passes the respon… | |
| 34 | Unauthorized Data Collection | medium | js/insert-script-content-chrome.js (line 765) | TakeSnapshot helper clones the entire <body> and <head> of the page, walks into every iframe (J() reads contentDocument and inlines its HTML), strips scripts, applies a regex masking pass, and serializes the result. T… | |
| 35 | Unauthorized Data Collection | medium | js/other-content-chrome.js (line 5446) | Reads iframe contentDocument and writes it back into the parent DOM via innerHTML interpolation of attacker-influenceable strings. Combined with the snapshot uploader, iframe contents accessible to the page (including… | |
| 36 | Unauthorized Data Collection | medium | js/insert-script-content-chrome.js (line 1852) | The job runner polls a remote endpoint for inbound emails associated with the current job (using an `ephemeralEmailAddress` returned by the server). This pulls third-party email content (e.g. confirmation links from d… | |
| 37 | Code Injection | low | js/insert-script-content-chrome.js (line 941) | The 'galactus-exec-in-page-context' mechanism injects a <script> element whose innerHTML is dynamically built from a JS function and a JSON-stringified arg, then inserted into document.documentElement so it executes i… | |
| 38 | Credential Theft | low | js/specific-webpage-content-chrome.js (line 1068) | On aura.com / identityguard.com / localhost, the content script enumerates every localStorage value, JSON-parses each, searches for any object containing an 'auth' field, and harvests accessToken/refreshToken to perfo… | |
| 39 | Credential Theft | low | js/specific-webpage-content-chrome.js (line 1061) | Content script (scoped to *.aura.com and localhost via the manifest) iterates every key in window.localStorage looking for a JSON value with an `auth` field, and forwards the resulting accessToken/refreshToken to the … | |
| 40 | Credential Theft | low | js/insert-script-content-chrome.js (line 3233) | HTTP Basic auth credentials (login:password) are base64-encoded and sent to the automation backend (automation.aurasvc.io). base64 of credentials is not encryption — the password is effectively plaintext on the wire a… | |
| 41 | Credential Theft | low | js/other-content-chrome.js (line 6364) | The content-script-side code holds and uses bearer access tokens (and refresh tokens) to call automation backends at `automation.aurasvc.io`. Although the host is a first-party Aura domain, embedding an authenticated … | |
| 42 | Network Interception | low | js/other-content-chrome.js (line 6660) | Hooks the page-global hcaptcha/grecaptcha objects on beenverified.com via Object.defineProperty setters, overriding getResponse() to return whatever value the extension has injected into the captcha textarea. This is … | |
| 43 | Other | low | js/intercept-captcha-iframe-chrome.js (line 761) | Hardcoded RSA public key paired with the figleafapp.com endpoint suggests an end-to-end encrypted channel between the extension and a non-Aura-branded backend (figleafapp.com is the prior FigLeaf brand acquired by Aur… | |
| 44 | Other | low | js/other-content-chrome.js (line 8024) | Builds an HTTP Basic Authorization header by base64-encoding a config-supplied login:password pair and POSTs it to automation.aurasvc.io to acquire automation execution tokens. The credentials originate from Aura's ow… | |
| 45 | Other | low | manifest.json (line 123) | Extension-pages CSP allows `wasm-unsafe-eval`, `connect-src *` (including data:, blob:, filesystem: schemes), `img-src *`, and `frame-src *`. Combined with `<all_urls>` host permissions and the scripting/declarativeNe… | |
| 46 | Other | low | manifest.json (line 113) | The extension's CSP relaxes two important defaults: `connect-src *` together with `data:`, `blob:`, and `filesystem:` allows the extension pages to issue fetch/XHR/WebSocket connections to any host (no allow-list of a… | |
| 47 | Privilege Escalation | low | js/apa-rpc-proxy-content-chrome.js (line 2629) | After opening a tab to a URL supplied via RPC from the Aura backend (https://automation.aurasvc.io), the extension uses chrome.scripting.executeScript with world:"MAIN" to inject an extension-bundled file (targetConte… | |
| 48 | Privilege Escalation | low | js/intercept-captcha-iframe-chrome.js (line 2726) | On a hardcoded list of people-search/data-broker domains (spokeo, allwebleads, peekyou, searchpeoplefree, onetrust privacyportal) the script polls for a populated g-recaptcha-response token and then invokes the page's… | |
| 49 | Privilege Escalation | low | js/specific-webpage-content-chrome.js (line 1245) | Creates a hidden same-origin iframe and writes auth/session payload (login email, accessToken, refreshToken) into its localStorage, then removes it — a side-channel to seed the parent origin's localStorage with creden… | |
| 50 | Privilege Escalation | low | js/specific-webpage-content-chrome.js (line 1233) | Creates a hidden same-origin iframe and writes attacker-influenced data (auth tokens, onboarding state) into the iframe's localStorage via `contentWindow.localStorage.setItem`. The iframe trick is used to avoid subtle… | |
| 51 | Remote Code Loading | low | js/apa-worker-content-chrome.js (line 46) | On *.aurasvc.io pages whose URL contains "worker-bundle-template", the content script injects the extension-packaged js/apa-worker-server-runner-chrome.js into the page's MAIN world by appending a <script> tag. The sc… | |
| 52 | Tracking | low | js/other-content-chrome.js (line 341) | Telemetry endpoint events.privacy.aurasvc.io/event receives extension events from a content script that runs in all frames on <all_urls>. Combined with broad host access this is a wide telemetry surface; whether PII i… | |
| 53 | Tracking | low | js/other-content-chrome.js (line 341) | All telemetry is posted to a vendor-controlled endpoint at `events.privacy.aurasvc.io/event`. This is standard product analytics, but the endpoint is not user-configurable and the payload schema is not visible from th… | |
| 54 | Tracking | low | js/overlay-content.js (line 9737) | The extension ships an analytics endpoint (events.privacy.aurasvc.io/event) referenced from an overlay rendered into <all_urls> pages. This is first-party telemetry (vendor-owned domain) rather than third-party tracki… | |
| 55 | Tracking | low | js/other-content-chrome.js (line 301) | Telemetry endpoint hard-coded into a content script that runs in every frame on every URL. Combined with the page-snapshot/masking helpers (`ge`, `ve`, `Ee` at lines ~5309-5400) which clone `document.body`/`document.h… | |
| 56 | Tracking | low | js/other-content-chrome.js (line 300) | Hardcoded analytics endpoint receives extension event telemetry. The events list (around line 322+) includes extension_install, extension_first_launch, extension_icon_click, and other usage events. This is standard pr… | |
| 57 | Unauthorized Data Collection | low | js/insert-script-content-chrome.js (line 3700) | Defines admin/executor REST clients that POST automation results, captcha tasks, ephemeral email contents, and execution reports to https://automation.aurasvc.io/api/v1/* using HTTP Basic / Bearer auth. Combined with … | |
| 58 | Unauthorized Data Collection | low | js/insert-script-content-chrome.js (line 2053) | Error telemetry includes a 'pageSnapshot' (HTML serialization of body+head, with iframe contents inlined and value masking applied) and the originating pageUrl, sent to a hardcoded Sentry ingestion endpoint when an AP… | |
| 59 | Unauthorized Data Collection | low | js/other-content-chrome.js (line 3108) | Heuristic field classifier that runs on every page and labels inputs as SSN, BankAccountNumber, DriversLicenseNumber, CreditCardNumber, BirthDate, OneTimePassword, etc. This is a legitimate password-manager / identity… | |
| 60 | Unauthorized Data Collection | low | js/insert-script-content-chrome.js (line 758) | Hardcoded RSA public key paired with the figleafapp.com endpoint indicates an asymmetrically-encrypted channel to a vendor backend (FigLeaf is an Aura brand). Not malicious by itself, but combined with the page automa… | |
