| 1 | Network Interception | critical | js/popup.js (line 1) | The popup fetches proxy server configurations from https://api.nucleusvpn.com/api/proxy over an unauthenticated HTTP GET with no integrity verification of the response. The returned proxy_list items are directly appli… | |
| 2 | Network Interception | critical | js/background.js (line 1) | The extension fetches its proxy server list from a remote third-party API (https://api.nucleusvpn.com/api/proxy) at runtime, meaning the operator can silently swap proxy servers at any time without a code update. All … | |
| 3 | Network Interception | critical | js/background.js (line 1) | The extension programmatically sets a browser-wide fixed proxy, routing all HTTP/HTTPS traffic through an operator-controlled server fetched from a remote API. Critically, the bypassList explicitly exempts only the nu… | |
| 4 | Network Interception | critical | js/popup.js (line 3) | The proxy server management code (including remote proxy list fetching from nucleusvpn.com) is bundled into popup.js as well as background.js, confirming the extension's architecture relies entirely on operator-contro… | |
| 5 | Network Interception | critical | js/background.js (line 1) | The extension fetches its entire proxy server list from a remote third-party API (api.nucleusvpn.com/api/proxy) and then routes all of the user's browser traffic through one of these dynamically-retrieved servers. The… | |
| 6 | Code Injection | high | js/background.js (line 1) | The background script injects runtime-constructed JavaScript code strings into every tab on every tab creation and update event via tabs.executeScript, using insertAdjacentHTML to inject HTML into document.body of eve… | |
| 7 | Code Injection | high | js/background.js (line 1) | The background script injects JavaScript code strings into every open browser tab via tabs.executeScript on tab creation (chrome.tabs.onCreated) and tab update (chrome.tabs.onUpdated) events, using insertAdjacentHTML … | |
| 8 | Data Exfiltration | high | js/background.js (line 1) | When the VPN proxy is active, the bypass list explicitly exempts all traffic to *.api.nucleusvpn.com from being routed through the VPN tunnel. This means API calls to the extension's backend server travel over the use… | |
| 9 | Network Interception | high | js/popup.js (line 1) | The proxy connectivity check temporarily sets a PAC script that interpolates the proxy server address (Ov) directly into the PAC script string without sanitization, creating a PAC script injection vector if the proxy … | |
| 10 | Network Interception | high | js/background.js (line 1) | The proxy health-check uses a dynamically constructed PAC script with a server-controlled host value interpolated directly into the script string. PAC scripts have full routing authority over all browser traffic, and … | |
| 11 | Tracking | high | js/background.js (line 1) | The extension generates and persistently stores a unique client UUID (via uuid v4) in chrome.storage.local under the key 'cid', then sends it along with the extension's runtime ID as a Google Analytics pageview hit (U… | |
| 12 | Tracking | high | js/background.js (line 1) | The background script silently generates a persistent UUID (stored as 'cid') and fires a Google Analytics beacon (UA-208747416-1) on every background page load, transmitting this unique identifier along with the exten… | |
| 13 | Tracking | high | js/background.js (line 1) | The extension silently generates a persistent UUID (stored as 'cid' in chrome.storage.local) and transmits it to Google Analytics (UA-208747416-1) as a pageview hit every time the background script initializes, withou… | |
| 14 | Tracking | high | js/background.js (line 1) | The Google Analytics tracker UA-208747416-1 is initialized unconditionally in the background page, with no opt-out mechanism visible in the code. Combined with the persistent CID generation, this means every user is t… | |
| 15 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension listens to every tab creation and update event across all browser tabs and triggers a script injection function for each, immediately followed by a Google Analytics initialisation call. Combined with the… | |
| 16 | Code Injection | medium | js/background.js (line 1) | The background script injects a dynamically-constructed JavaScript code string into every browser tab (excluding chrome:// and Web Store URLs) via browser.tabs.executeScript with an inline code payload. The injected s… | |
| 17 | Privilege Escalation | medium | manifest.json (line 1) | The manifest declares a content script that runs at document_start (before any page content loads) on every HTTP/HTTPS URL, in all frames including about:blank frames. The 'early execution' capability combined with 'a… | |
| 18 | Tracking | medium | js/background.js (line 1) | The analytics beacon (Google Analytics UA-208747416-1) fires unconditionally on every background script startup with no user consent mechanism. This call is made after registering tab creation/update listeners that pr… | |
| 19 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension fetches the user's real public IP address from the third-party service https://ifconfig.me/ip, a service not controlled by the extension publisher. Every call causes ifconfig.me to log the requesting IP … | |
| 20 | Unauthorized Data Collection | medium | js/background.js (line 1) | The background script registers listeners on every tab creation and every tab update event browser-wide, then reads the full tab URL via browser.tabs.get on each event. Combined with the <all_urls> and proxy permissio… | |
| 21 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension fetches the user's real public IP address from ifconfig.me and stores/exposes it in extension logic. This leaks the user's true identity to a third-party service (ifconfig.me) on a regular basis, and the… | |
| 22 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension repeatedly contacts the third-party IP-lookup service ifconfig.me to verify proxy connectivity and to retrieve the user's current public IP address for display. Each call to getIp() leaks the current IP … | |
