| 1 | Code Injection | critical | background.js (line 1) | The extension injects a sophisticated remote-controlled DOM manipulation framework (function M) into all tabs via chrome.scripting.executeScript. This framework supports: creating arbitrary DOM elements with custom in… | |
| 2 | Credential Theft | critical | background.js (line 1) | The extension reads all browser cookies via chrome.cookies.getAll() across all domains (using <all_urls> host permission), enumerates all cookie stores, and can set persistent tracking cookies with an expiration date … | |
| 3 | Data Exfiltration | critical | background.bund.js (line 1792) | Captured network events are buffered and sent to the backend under the `net_items` action. This is not just local filtering logic; it is explicit exfiltration of collected browsing/request metadata to a remote server. | |
| 4 | Data Exfiltration | critical | background.js (line 1) | The extension defines four hardcoded C2 (command-and-control) domains — sqoutout.com, thesqout.com, ext.sqoutout.com, ext.sqouterr.com — and three server-side API endpoints: /api/sq/post (data exfiltration), /api/sq/t… | |
| 5 | Network Interception | critical | background.bund.js (line 2882) | This installs broad `webRequest` listeners on `<all_urls>` for main frames, subframes, scripts, images, XHR, and more, including access to request and response headers. Combined with the background batching code, this… | |
| 6 | Network Interception | critical | background.js (line 1) | The extension registers six separate webRequest event listeners covering the full request lifecycle — BeforeRequest, BeforeSendHeaders (with requestHeaders), ResponseStarted, BeforeRedirect (with responseHeaders), Com… | |
| 7 | Obfuscation | critical | background.js (line 1) | The extension implements a custom XOR-based payload obfuscation scheme. Outgoing POST request bodies are XOR-encrypted with a hardcoded key and base64-encoded before transmission, using a non-standard 'application/x-b… | |
| 8 | Privilege Escalation | critical | background.js (line 1) | The extension uses chrome.management.getAll() to enumerate all installed browser extensions, then reports the list — including extension IDs, names, descriptions, icons, and enabled status — to the sqout C2 servers un… | |
| 9 | Code Injection | high | background.bund.js (line 1124) | The extension has a generic script-injection bridge that can be pushed into arbitrary tabs, create DOM elements from supplied HTML, read selected elements, and replace `outerHTML`. A reusable message-driven DOM manipu… | |
| 10 | Obfuscation | high | background.bund.js (line 782) | The extension posts collected data to a remote endpoint with `credentials: "include"`, so browser cookies for the vendor domain are sent along with the request. It also supports XOR-plus-base64 encoding of the JSON bo… | |
| 11 | Tracking | high | background.js (line 1) | The extension tracks and beacons every management event (extension install, uninstall, enable, disable) to the sqout C2 servers in real time, along with the affected extension's full info object. It also monitors user… | |
| 12 | Unauthorized Data Collection | high | background.bund.js (line 576) | This builds a telemetry payload containing local time/timezone, language, active tab ID, permission set, management permission state, device/runtime identifiers, and other configuration data. That is unusually broad c… | |
| 13 | Unauthorized Data Collection | high | background.bund.js (line 5358) | The extension monitors extension-management events and reports details of other extensions being enabled, disabled, installed, or uninstalled. Collecting an inventory/change log of the user's extension ecosystem is se… | |
| 14 | Unauthorized Data Collection | high | background.js (line 1) | The extension assembles a detailed profile of all other installed extensions (IDs, names, descriptions, enabled status, icon URLs) and sends it to the sqout C2 via the /api/sq/post endpoint. The server then returns a … | |
| 15 | Tracking | medium | background.bund.js (line 2429) | This code defines stable tracking identifiers (`uid`, `utm_source`, `mid`, `prid`) and synchronizes them across `syncDomains`. Cross-domain propagation of persistent IDs is a classic tracking pattern and is difficult … | |
