| 1 | Privilege Escalation | critical | js/background.js (line 1) | The extension exposes an entirely open `chrome.runtime.onMessageExternal` listener with no origin validation or authentication, accepting commands from any external webpage or extension. The `get_config` action dumps … | |
| 2 | Privilege Escalation | critical | js/background.js (line 1) | The background script exposes an onMessageExternal listener that accepts commands from any external website or extension with no origin validation. The get_config action leaks the entire chrome.storage.local contents … | |
| 3 | Code Injection | high | js/background.js (line 1) | On installation, the background script queries all open browser tabs and programmatically injects js/customCursor.js into every tab with an HTTP/HTTPS URL via chrome.tabs.executeScript. Combined with the all_urls perm… | |
| 4 | Privilege Escalation | high | js/background.js (line 1) | The extension exposes a broad external messaging API via `chrome.runtime.onMessageExternal` with no `externally_connectable` restrictions in the manifest, meaning any other installed extension can send messages to it.… | |
| 5 | Tracking | high | js/background.js (line 1) | The extension generates and persists a unique client ID (UUID) in chrome.storage.local, then sends a Google Analytics Measurement Protocol pageview beacon to https://www.google-analytics.com/collect on every backgroun… | |
| 6 | Unauthorized Data Collection | high | js/background.js (line 1) | On install the extension opens a tab to the third-party domain `ladnet.co` with the extension's runtime ID embedded in the URL, enabling the remote server to fingerprint and track individual extension installs. The `o… | |
| 7 | Code Injection | medium | js/popup.js (line 3) | The content script builds a CSS string from `xT.cursor.path` and `xT.pointer.path` values read directly from `chrome.storage.local` and injects them via `innerHTML` into a `<style>` element on every visited page. If a… | |
| 8 | Code Injection | medium | js/background.js (line 1) | On extension installation, the background script programmatically injects `customCursor.js` into every currently-open HTTP tab by iterating through the full tab list. This is separate from the declarative `content_scr… | |
| 9 | Tracking | medium | js/background.js (line 1) | On every extension startup, the background script generates or retrieves a persistent UUID (`cid`) stored in `chrome.storage.local` and sends it as a Google Analytics Measurement Protocol pageview hit to `https://www.… | |
| 10 | Unauthorized Data Collection | medium | js/background.js (line 1) | The background script generates a persistent UUID client ID stored in chrome.storage.local under 'cid' and sends a Google Analytics Measurement Protocol pageview hit (UA-211090075-1) on every background page load, tra… | |
| 11 | Unauthorized Data Collection | medium | js/background.js (line 1) | The `authSync` method runs on a 10-second repeating timer and continually copies the user's full cursor pack inventory (all item IDs, collection slugs, size settings) into `chrome.storage.sync`, which is tied to the u… | |
| 12 | Unauthorized Data Collection | medium | js/popup.js (line 4) | The `reload()` method calls `chrome.tabs.query({})` with an empty filter to enumerate every open tab across all windows, then broadcasts a message to each tab ID. This gives the popup complete visibility into all open… | |
| 13 | Unauthorized Data Collection | medium | js/background.js (line 1) | The authSync method continuously syncs the user's installed cursor pack IDs to chrome.storage.sync every 10 seconds via an unbounded setTimeout self-loop. Because chrome.storage.sync is tied to the user's Google accou… | |
| 14 | Unauthorized Data Collection | low | js/settings.js (line 2) | The settings page reads user-uploaded files via `FileReader.readAsDataURL()` and persistently stores the full base64-encoded file content, original filename, and byte size in `chrome.storage.local`. There is minimal f… | |
