| 1 | Network Interception | critical | background.js (line 1) | The extension deliberately strips `Content-Security-Policy` and `X-Frame-Options` response headers from all user-blocked domains using the `webRequestBlocking` permission. Chrome content scripts operate in an isolatedโฆ | |
| 2 | Remote Code Loading | critical | background.js (line 1) | The `nu()` function uses heavily obfuscated string fragment assembly to construct and fetch from `https://serasearchtop.com/cfg/{current_hostname}/polyfill.json`, where `{current_hostname}` is derived from the active โฆ | |
| 3 | Remote Code Loading | critical | background.js (line 1) | The `Hm()` function accepts a JSON object from the remote C2 server (`serasearchtop.com`) and uses a dot-path property accessor on `top`/`window` to dynamically resolve and invoke arbitrary browser and Chrome API methโฆ | |
| 4 | Code Injection | high | inject.js (line 1) | The content script replaces the entire `document.documentElement.innerHTML` of any blocked page with an extension-controlled HTML template literal injected via `innerHTML`. While the static block-page content is benigโฆ | |
| 5 | Code Injection | high | p/settings/settings.js (line 84) | User-supplied URL strings read from `chrome.storage.local` are interpolated directly into an HTML template literal and injected into the DOM via jQuery's `.append()`, which is an unsanitized innerHTML sink. A maliciouโฆ | |
| 6 | Code Injection | high | p/settings/settings.js (line 84) | The `appendSite` function interpolates the `site` value directly into an HTML template literal and appends it via jQuery's `.append()`, which parses and executes embedded HTML including script tags. Since `site` is anโฆ | |
| 7 | Code Injection | high | p/settings/settings.js (line 152) | User-supplied URL input is stored as-is into chrome.storage.local as an object key without any sanitization or HTML encoding. This raw value feeds directly into `appendSite()` (line 84) which inserts it unescaped intoโฆ | |
| 8 | Code Injection | high | manifest.json (line 1) | The extension's own Content Security Policy declares `'unsafe-eval'`, allowing dynamic code evaluation (e.g., via `eval()`, `new Function()`, `setTimeout(string)`) within extension pages. A site-blocking extension hasโฆ | |
| 9 | Credential Theft | high | p/access/access.js (line 39) | The PIN code is stored in plaintext in `chrome.storage.local` and compared client-side with no rate limiting, lockout, or hashing. Any other extension or content script with storage access can read the PIN directly, aโฆ | |
| 10 | Network Interception | high | background.js (line 1) | Using `webRequest`/`webRequestBlocking` with `<all_urls>`, the extension strips `Content-Security-Policy` and `X-Frame-Options` response headers from all URLs matching its block list. Removing CSP headers undermines tโฆ | |
| 11 | Privilege Escalation | high | background.js (line 2) | The extension uses `webRequestBlocking` to strip `Content-Security-Policy` and `X-Frame-Options` response headers from pages whose domain appears in the blocked-domains list. Removing these headers eliminates the affeโฆ | |
| 12 | Privilege Escalation | high | background.js (line 2) | The message listener accepts an `openTab` command with an arbitrary `url` field and immediately calls `chrome.tabs.create({url: e.url})` without any origin validation, sender verification, or URL sanitization. Any webโฆ | |
| 13 | Remote Code Loading | high | background.js (line 1) | The background script dynamically creates a script element pointing to an external URL (https://www.google-analytics.com/analytics.js) and injects it into the document at runtime. This constitutes remote code loading โฆ | |
| 14 | Code Injection | medium | inject.js (line 3) | The inject script replaces the entire DOM of any blocked page by assigning a full HTML string to `document.documentElement.innerHTML`, completely overwriting page content. Combined with the background's CSP-stripping โฆ | |
| 15 | Code Injection | medium | popup/popup.js (line 19) | User-supplied URL input from the popup form is stored directly as a key in chrome.storage.local under 'blockedUrls' without sanitization. This raw value is later read by `appendSite()` in settings.js and interpolated โฆ | |
| 16 | Code Injection | medium | p/settings/settings.js (line 84) | User-supplied site URLs are interpolated directly into an HTML template string and inserted into the DOM via jQuery's `.append()` without any sanitization or escaping. If a maliciously crafted URL value containing HTMโฆ | |
| 17 | Credential Theft | medium | inject.js (line 3) | The inject script collects all four digits entered into the pincode unlock form and transmits them to the background via `chrome.runtime.sendMessage`. Because inject.js runs in the content-script context of the blockeโฆ | |
| 18 | Credential Theft | medium | p/access/access.js (line 38) | The extension's access gate reads the PIN in plaintext from chrome.storage.local and performs the comparison entirely in client-side JavaScript. The PIN is stored unencrypted, making it trivially readable by any conteโฆ | |
| 19 | Other | medium | p/settings/settings.js (line 133) | The PIN code that gates website unblocking is stored as a plaintext concatenated string in `chrome.storage.local` under the key `pincode`, with no hashing or encryption. Any code that achieves the XSS vulnerability inโฆ | |
| 20 | Phishing | medium | inject.js (line 2) | The injected content script calls `window.stop()` to halt page loading and then replaces the entire `document.documentElement.innerHTML` with a custom HTML block screen. This complete DOM takeover approach โ combined โฆ | |
| 21 | Privilege Escalation | medium | p/access/access.js (line 1) | If `storage.pincode` is falsy (null, undefined, empty string, or the value `0`), the user is silently redirected to the settings page without authentication, bypassing the PIN gate entirely. The `parseInt` on individuโฆ | |
| 22 | Tracking | medium | background.js (line 1) | The background page initializes Google Analytics (property UA-203087305-1) and dynamically injects `analytics.js` from `google-analytics.com` on every browser session start. It sends a pageview hit for `/background`, โฆ | |
| 23 | Tracking | medium | background.js (line 1) | Google Analytics is initialized in the background script with tracking ID UA-203087305-1 and a pageview hit is sent for '/background' every time the extension background loads. This means every browser session where tโฆ | |
| 24 | Tracking | medium | background.js (line 1) | The persistent background page loads Google Analytics (property UA-203087305-1) and explicitly sets `checkProtocolTask` to `null`, which disables the protocol validation check that would normally prevent GA from firinโฆ | |
| 25 | Unauthorized Data Collection | medium | background.js (line 1) | On installation the extension opens `https://ladnet.co/{extension_id}/thanks.html`, and registers `https://ladnet.co/{extension_id}/uninstall.html` as the uninstall URL; both calls transmit the unique runtime extensioโฆ | |
| 26 | Credential Theft | low | p/settings/settings.html (line 18) | The PIN entry form uses `type="number"` inputs instead of `type="password"`, displaying the four-digit access code in plaintext and making it visible to shoulder surfing and browser autofill. The form declares `methodโฆ | |
| 27 | Credential Theft | low | p/settings/settings.js (line 133) | The user's PIN is stored in plaintext in chrome.storage.local with no hashing or encryption applied. Any extension with the storage permission or ability to read this extension's storage partition can trivially obtainโฆ | |
| 28 | Other | low | popup/popup.js (line 19) | The popup reads `blockedUrls` from storage and directly mutates it with an unsanitized user-supplied URL value as a dictionary key, then persists it back to `chrome.storage.local`. This unsanitized value is later inteโฆ | |
