| 1 | Code Injection | critical | main.bundle.js (line 1081) | The injected main.bundle.js assembles arbitrary JavaScript code from the hidden DOM elements populated by the content script and executes it by creating a script element, appending it to the document, then immediately… | |
| 2 | Code Injection | critical | main.bundle.js (line 1081) | This code assembles JavaScript from rule content and injects it into the page via an inline `<script>` element. Because those rule entries are populated elsewhere from the extension's rule feed, this is an arbitrary p… | |
| 3 | Network Interception | critical | background.bundle.js (line 2961) | The extension implements a full affiliate fraud infrastructure with named rule types: PARTNER_CHANGE_UA (spoofs User-Agent for partner URLs), REDIRECTS (intercepts and redirects partner traffic), PARTNER_INITIATOR (co… | |
| 4 | Network Interception | critical | background.bundle.js (line 2390) | Seven distinct functions ($, L, M, q, H, G, B, X) systematically replace User-Agent request headers across every resource type including main_frame, xmlhttprequest, and websocket for targeted URL patterns. This high-p… | |
| 5 | Unauthorized Data Collection | critical | content.bundle.js (line 1672) | The content script actively polls every visited page's localStorage for a key named 'activeCurrP' (250ms interval) and exfiltrates its value to the background service worker via the '@check_partner' message. It also t… | |
| 6 | Unauthorized Data Collection | critical | background.bundle.js (line 3387) | The @check_partner message handler receives the 'activeCurrP' value harvested from visited pages' localStorage and the current tab URL, then calls Y() which cross-references the stored 'partnersUA' rules to apply doma… | |
| 7 | Code Injection | high | content.bundle.js (line 1696) | The content script creates a hidden DOM element (100% offscreen, display:none, zero-sized) and populates it with server-fetched rule data encoded as paragraph elements. It then injects 'main.bundle.js' as a page-world… | |
| 8 | Data Exfiltration | high | background.bundle.js (line 2856) | Immediately upon installation, the extension fires a conversion tracking beacon to 'https://clean-blocker.com/conversion' after clearing all existing declarativeNetRequest session rules. This signals a fraudulent inst… | |
| 9 | Network Interception | high | background.bundle.js (line 2419) | The extension dynamically installs DNR rules that rewrite request headers for broad traffic classes, including `xmlhttprequest` and `websocket`, and adds a custom `x-custom-ua` header. This is a network interception c… | |
| 10 | Obfuscation | high | background.bundle.js (line 2923) | Rule types named 'ASSISTANT_EXEC' and 'ASSISTANT' with obfuscated delimiters ('@%@%@%@' and '#%#') alongside 'COSMETIC_CSS_EXEC' ('@@$@$@$@') suggest a covert command channel embedded in the rule list fetched from the… | |
| 11 | Remote Code Loading | high | background.bundle.js (line 2362) | The background fetches behavioral rule sets from 'https://api.clean-blocker.com/info/object-data' and homepage redirect URLs from '/info/homepage' at runtime. These remote-fetched payloads are parsed into partner UA-s… | |
| 12 | Remote Code Loading | high | background.bundle.js (line 3044) | This function refreshes the extension's rule set from a remote source and replaces the local `listRules` and `staticRules` with server-provided values. That creates a post-install control channel where backend data ca… | |
| 13 | Tracking | medium | background.bundle.js (line 2826) | On install, the extension stores remote-controlled install/uninstall endpoints and force-updates active tabs to the chosen install page. This is suspicious traffic-redirect and attribution behavior, especially because… | |
| 14 | Unauthorized Data Collection | medium | content.bundle.js (line 1680) | The content script runs on every HTTP(S) page at `document_start`, reads per-site `localStorage`, and forwards both the page URL and page-controlled storage values to the background script. Pulling arbitrary site-loca… | |
