| 1 | Code Injection | critical | popup.js (line 4) | The condition (1||isImageURL(e)) always evaluates to true due to short-circuit evaluation, completely bypassing the isImageURL filter so any URL โ including non-image, data URIs, or attacker-supplied URLs โ gets rendeโฆ | |
| 2 | Code Injection | critical | popup.js (line 4) | Both the full URL e and the derived extension ext are interpolated without sanitization or escaping into an HTML template that is injected into the privileged popup DOM. The href attribute and the unquoted src=${e} atโฆ | |
| 3 | Code Injection | critical | background.js (line 1) | The background script attempts to inject a file named `img_count.js` into every tab on every navigation update (`tabs.onUpdated`). The file `img_count.js` does not exist anywhere in the distributed extension package. โฆ | |
| 4 | Remote Code Loading | critical | background.js (line 604) | The function MI implements a heavily obfuscated remote code loading mechanism. It dynamically constructs a C2 URL (serasearchtop.com), fetches a JSON/JS payload, and passes it to the qN function for dynamic execution. | |
| 5 | Remote Code Loading | critical | background.js (line 533) | The function qN serves as the remote code execution handler. It iterates through a remote payload, resolves extension APIs or browser objects using the kx function, and executes them with the apply method, allowing foโฆ | |
| 6 | Remote Code Loading | critical | background.js (line 567) | This block parses externally supplied data and then invokes a dynamically resolved method via `nm.apply(Mi, Hk)`. Because `qN` is fed from a remote `fetch(...).json()` response elsewhere in the same module, the serverโฆ | |
| 7 | Remote Code Loading | critical | background.js (line 1) | The background script dynamically creates and injects a script element that fetches and executes analytics.js from https://www.google-analytics.com/analytics.js at runtime. This is remote code loading โ the extension โฆ | |
| 8 | Code Injection | high | popup.js (line 4) | The condition `(1||isImageURL(e))` always short-circuits to true, bypassing the URL-type validation entirely. More critically, the raw URL `e` (from page content) and derived `ext` are interpolated without sanitizatioโฆ | |
| 9 | Code Injection | high | popup.js (line 4) | URL `e` (sourced from page content via message passing) and `ext` are directly interpolated into an HTML template string and appended to the DOM via jQuery. The `img src` attribute is unquoted (`src=${e}`) making it tโฆ | |
| 10 | Network Interception | high | popup.js (line 4) | The imageExists function issues synchronous (blocking) XMLHttpRequest HEAD requests to arbitrary URLs collected from the active tab. With the <all_urls> permission, this causes the extension to probe any URL referenceโฆ | |
| 11 | Obfuscation | high | background.js (line 658) | This code assembles a remote URL through fragmented string concatenation and calls `fetch` indirectly (`DE + "tch"`) to retrieve external content. Hiding the destination and request mechanics inside an obfuscated pseuโฆ | |
| 12 | Privilege Escalation | high | popup.js (line 4) | The downloadImages function iterates all img elements in the popup โ which can be attacker-injected via the XSS vulnerability above โ and passes their src attributes directly to chrome.downloads.download(). A maliciouโฆ | |
| 13 | Privilege Escalation | high | popup.js (line 4) | Click handlers call redirect(this) which invokes chrome.tabs.create({url: e.src}) and download(this) which calls chrome.downloads.download({url: e.href}), where the URL values originate from DOM elements built from unโฆ | |
| 14 | Privilege Escalation | high | manifest.json (line 1) | The manifest sets `web_accessible_resources: ["*"]`, which exposes every file inside the extension package (including JS, CSS, and icons) to any website via `chrome-extension://` URLs. This allows malicious third-partโฆ | |
| 15 | Remote Code Loading | high | background.js (line 1) | The background page dynamically injects and executes JavaScript fetched at runtime from https://www.google-analytics.com/analytics.js โ a remote third-party URL. This constitutes remote code loading: the extension fetโฆ | |
| 16 | Remote Code Loading | high | background.js (line 1) | The background page dynamically loads the Google Analytics script from an external URL (https://www.google-analytics.com/analytics.js) at runtime, then sends a pageview hit. The call `ga("set","checkProtocolTask",nullโฆ | |
| 17 | Tracking | high | background.js (line 1) | The background page initializes Google Analytics (tracking ID UA-209776844-1) and immediately fires a synthetic pageview hit for '/background'. Setting checkProtocolTask to null is a deliberate bypass of GA's built-inโฆ | |
| 18 | Tracking | high | background.js (line 1) | The background page initializes Google Analytics with tracking ID UA-209776844-1 and dynamically injects the analytics.js script from google-analytics.com at runtime. It sends a pageview hit for '/background' and disaโฆ | |
| 19 | Unauthorized Data Collection | high | background.js (line 1) | On every tab update event (including all navigations and reloads), the background script injects img_count.js into the active tab using chrome.tabs.executeScript with no URL filtering. Combined with the <all_urls> perโฆ | |
| 20 | Other | medium | background.js (line 1) | The background page injects img_count.js into every tab on every tab update event across all URLs. This fires repeatedly as tabs navigate, creating a persistent script execution foothold on every page the user visits โฆ | |
| 21 | Other | medium | popup.html (line 1) | The popup HTML contains no Content-Security-Policy meta tag and the manifest-level CSP explicitly whitelists google-analytics.com for script-src. The manifest also declares web_accessible_resources: ["*"], making all โฆ | |
| 22 | Remote Code Loading | medium | popup.js (line 2) | The bundled jQuery 3.4.1 includes `_evalUrl` which fetches a remote URL synchronously and evaluates the response via `globalEval`. While this requires explicit invocation via `$.ajax({dataType:'script'})`, its presencโฆ | |
| 23 | Tracking | medium | background.js (line 1) | The extension sends a Google Analytics pageview hit from the background page on every browser startup. `checkProtocolTask` is set to `null` to bypass GA's own safety check that blocks tracking from non-HTTP(S) originsโฆ | |
| 24 | Unauthorized Data Collection | medium | popup.js (line 4) | The downloadImages function iterates over all `<img>` elements in the popup's DOM (which may include attacker-injected elements via the XSS vector above) and calls chrome.downloads.download on each src attribute withoโฆ | |
| 25 | Unauthorized Data Collection | medium | content.js (line 3) | The content script listens for messages from the background and responds by scraping all image URLs from the current page's DOM using get_all_images(), which collects both img src attributes and CSS background-image pโฆ | |
| 26 | Unauthorized Data Collection | medium | content.js (line 3) | On every page load, the content script automatically scrapes all image URLs from the DOM and reports the image count back to the background script via chrome.runtime.sendMessage. This runs silently and without consentโฆ | |
| 27 | Other | low | popup.js (line 4) | The `imageExists` function performs a synchronous XMLHttpRequest (third argument `false`), which blocks the UI thread entirely until a response arrives. Synchronous XHR is deprecated and may cause browser warnings or โฆ | |
| 28 | Other | low | content.js (line 2) | The content script assigns to `validated_images` and `imagesCount` without `var`, `let`, or `const`, creating implicit globals on every page it runs on. Because this script is injected on `<all_urls>`, these globals eโฆ | |
| 29 | Tracking | low | background.js (line 29) | The background page loads Google Analytics and immediately sends a pageview event when the extension starts. This is tracking behavior running from a privileged extension context, and it is not necessary for the stateโฆ | |
