CleanTab Refresh

On each toolbar click, the extension enumerates every open tab with an unfiltered chrome.tabs.query({}) call and then injects a script into ALL frames of every tab using chrome.scripting.executeScript with allFrames: true. The currently injected function (Dc) only sets window.onbeforeunload = null, but the injection infrastructure combined with the <all_urls> host permission creates a powerful arbitrary code execution surface across the entire browser. Any update to the bundled function Dc could silently deploy malicious payloads to all open tabs without user awareness.

chrome.action.onClicked.addListener((async () => {  await Zv(), chrome.action.setIcon({      ...    }),    await Yo();  const Hz = await chrome.tabs.query({});  for (const MU of Hz) {    const Hz = MU.id;    if (Hz) {      try {        await chrome.scripting.executeScript({          func: Dc,          target: {            tabId: Hz,            allFrames: !0          }        })      } catch (Hz) {}      await chrome.tabs.reload(Hz, {        bypassCache: !0      })    }  }}))

The entire background.js (~684 lines) is aggressively obfuscated using two-character meaningless variable names (Hz, MU, qG, Bz, Zv, Yo, Dc, KM, etc.) throughout all 16 bundled modules. This pervasive obfuscation is not consistent with legitimate tab-refresh functionality and is a classic technique used to hide malicious payloads from static analysis. The obfuscation pattern is applied uniformly and systematically, indicating deliberate intent to conceal code behavior.

! function() {  function Hz(MU, qG, Bz) {    function Zv(Dc, KM) {      if (!qG[Dc]) {        if (!MU[Dc]) {          var Ds = "function" == typeof require && require;          if (!KM && Ds) return Ds(Dc, !0);          if (Yo) return Yo(Dc, !0);          var ld = new Error("Cannot find module '" + Dc + "'");          throw ld.code = "MODULE_NOT_FOUND", ld        }        var RJ = qG[Dc] = {          exports: {}        };        MU[Dc][0].call(RJ.exports, (function(Hz) {          var qG;          return Zv(MU[Dc][1][Hz] || Hz)        }), RJ, RJ.exports, Hz, MU, qG, Bz)      }      return qG[Dc].exports    }

A declarativeNetRequest rule is installed that modifies the Cache-Control request header to 'no-cache' on ALL URLs (urlFilter: '|*') for 7 resource types including main_frame, sub_frame, and script. While the header value itself seems benign, intercepting and rewriting headers on every HTTP request across all browsing activity far exceeds what a tab-refresh utility would need. This blanket header modification rule could be used to force cache misses that cause re-fetching of resources, or as groundwork for more advanced network manipulation.

async function Yo() {  await chrome.declarativeNetRequest.updateSessionRules({    addRules: [{      id: 1,      action: {        type: "modifyHeaders",        requestHeaders: [{          header: "Cache-Control",          operation: "set",          value: "no-cache"        }]      },      condition: {        excludedInitiatorDomains: [chrome.runtime.id],        urlFilter: "|*",        resourceTypes: ["main_frame", "sub_frame", "stylesheet", "script", "image", "object",          "media"        ]      }    }]  })}

On every extension startup, a persistent UUID ('cid') is generated via uuid.v4() and stored in chrome.storage.local if one does not already exist. This creates a stable, cross-session user identifier. While no explicit exfiltration endpoint is visible in this code, persisting a unique client ID is a prerequisite for user tracking, and the identifier could be transmitted via the network header manipulation or script injection mechanisms present elsewhere in the extension.

async function KM() {    const Hz = await chrome.storage.local.get(["cid"]);    let {      cid: MU    } = Hz;    return MU || (MU = (0, Bz.v4)(), chrome.storage.local.set({      cid: MU    })), MU  }  ...  KM()

A recurring alarm fires every 60 seconds and calls Zv() which removes the active declarativeNetRequest rule. Combined with the click handler that re-installs the rule, this creates a rhythmic on/off cycle for the header-modification rule. The 1-minute heartbeat alarm keeping the service worker alive and continuously managing network rules is inconsistent with a simple tab-refresh utility and suggests the extension is designed for persistent background operation beyond its stated purpose.

chrome.alarms.create("cleanup", {  periodInMinutes: 1}), chrome.alarms.onAlarm.addListener((() => {  Zv(), chrome.action.setIcon({    path: {      128: "../icons/icon128.png",      48: "../icons/icon48.png",      16: "../icons/icon16.png"    }  })}))