| 1 | Data Exfiltration | critical | background.js (line 1) | The nh() function constructs a C2 server URL by slicing fragments from module-scope array constants (KG, Ou) and concatenating obfuscated string literals. Static analysis decodes the construction as 'https://tryimv3sr… | |
| 2 | Data Exfiltration | critical | background.js (line 1) | The NO() function creates a chrome.alarms periodic alarm with a period of 720 minutes (12 hours), using an obfuscated alarm name assembled from string fragments. The alarm callback re-invokes PB() — the C2 beacon — en… | |
| 3 | Obfuscation | critical | background.js (line 1) | The kg() function builds an object that stores a reference to globalThis under an obfuscated property name reconstructed at runtime from string fragments, and registers itself as an 'exec' handler. It is deeply obfusc… | |
| 4 | Remote Code Loading | critical | background.js (line 1) | The PB() function installs a global 'message' event listener on the service worker (self.addEventListener('message', handler)) where the event name 'message' is obfuscated by concatenating string fragments at runtime … | |
| 5 | Remote Code Loading | critical | background.js (line 1) | The fetch() call to the obfuscated C2 URL (Eq = 'https://tryimv3srvsts.com/{extension_id}') parses the JSON response and merges it into the in-memory state object fH via Object.assign(). The condition (fH.s||NC)&&To(f… | |
| 6 | Code Injection | high | popup/popup.js (line 1) | jQuery's internal globalEval implementation creates a script element, sets its text to an arbitrary string, appends it to document.head to execute it, then removes it immediately. This DOM-based script injection techn… | |
| 7 | Phishing | high | background.js (line 728) | The extension contacts a third-party service to download runtime configuration, caches it locally, then uses server-provided URLs to open tabs on install/update and to set the uninstall URL. This gives an external ser… | |
| 8 | Privilege Escalation | high | background.js (line 1) | On installation the background script immediately queries all open tabs and programmatically injects content.js into every tab using chrome.scripting.executeScript. Normal dark-mode extensions do not need to forcibly … | |
| 9 | Privilege Escalation | high | background.js (line 1) | On installation, the background script queries ALL open tabs and programmatically injects content.js into every tab using chrome.scripting.executeScript. This bulk injection into all open tabs on install is overly agg… | |
| 10 | Remote Code Loading | high | popup/popup.js (line 3) | The bundled jQuery library ships with _evalUrl, which fetches a remote URL via AJAX and executes the response as JavaScript using globalEval. Although a standard jQuery feature, its presence in a popup that performs n… | |
| 11 | Tracking | high | background.js (line 1) | The extension generates and persists a unique UUID client ID in chrome.storage, then beacons a Google Analytics pageview hit on every background page load — including the extension's chrome.runtime.id as the document … | |
| 12 | Tracking | high | background.js (line 1) | The background script calls the Google Analytics Universal Analytics collect endpoint (https://www.google-analytics.com/collect) on every session, sending a persistent client ID, the extension's runtime ID, and pagevi… | |
| 13 | Tracking | high | background.js (line 1) | The extension silently generates a persistent UUID ('cid') stored in chrome.storage.local and sends it along with the extension's runtime ID to Google Analytics via the Measurement Protocol endpoint (https://www.googl… | |
| 14 | Unauthorized Data Collection | high | background.js (line 1) | The background script immediately invokes the analytics function with hardcoded Google Analytics tracking ID UA-239565490-1 at script load time, meaning every browser session sends a beacon to Google Analytics. The us… | |
| 15 | Unauthorized Data Collection | high | background.js (line 1) | The background script unconditionally fires the analytics tracker with hardcoded Google Analytics property ID 'UA-239565490-1' on module load (i.e., every time the service worker starts). There is no opt-in prompt, pr… | |
| 16 | Obfuscation | medium | popup/popup.js (line 1) | The entire popup.js file (101KB) is heavily minified and bundled into 2 lines with pervasive single-character variable name obfuscation (Up, gq, YV, HD, Em, Bb, FS, zK throughout). This makes static and manual analysi… | |
| 17 | Privilege Escalation | medium | background.js (line 1) | On installation, the background script immediately queries ALL open tabs (no active-tab scoping) and injects content.js into every one of them using chrome.scripting.executeScript. This is an aggressive content script… | |
| 18 | Tracking | medium | background.js (line 105) | The extension generates and persists a unique client ID in local storage, then sends it to Google Analytics on a recurring daily schedule. This is a persistent telemetry mechanism that can track extension installation… | |
| 19 | Tracking | medium | background.js (line 1) | A persistent UUID (cid) is generated on first run and stored in chrome.storage.local, then reused on every subsequent analytics call. This creates a stable, persistent identifier that uniquely tracks the user across a… | |
| 20 | Unauthorized Data Collection | medium | popup/popup.js (line 3) | The popup reads the active tab's full URL and stores the extracted hostname into chrome.storage.local under the 'blacklist' key. While the stated purpose is a site blacklist for dark-mode toggling, this constitutes sy… | |
| 21 | Unauthorized Data Collection | medium | popup/popup.js (line 3) | The extension reads the URL of the currently active tab via chrome.tabs.query and stores extracted domain information in chrome.storage.local under the key 'blacklist'. While presented as a user-controlled blacklist f… | |
| 22 | Code Injection | low | content.js (line 1) | The content script dynamically fetches CSS files from the extension package using a variable derived from URL matching. While the fetch is scoped to chrome.runtime.getURL, the dynamic path construction could be abused… | |
| 23 | Tracking | low | css/whatsapp.css (line 10) | This stylesheet embeds remote image URLs instead of packaging assets locally. When applied on matching sites, the browser will request these third-party resources, which can leak page visit metadata and create passive… | |
| 24 | Tracking | low | css/twitch.css (line 95) | This CSS references an unsecured HTTP asset hosted on an unrelated third-party domain. Besides leaking browsing activity, loading mixed external content from a non-extension domain is a poor security practice and coul… | |
