| 1 | Credential Theft | critical | background/background.js (line 1) | Every clipboard snapshot captured by the 3-second polling loop is prepended to a persistent 'archive' array in chrome.storage.local with full date/time metadata. This creates a complete chronological log of everythingโฆ | |
| 2 | Remote Code Loading | critical | background/background.js (line 1) | The YZ() function uses heavily obfuscated string concatenation via substring operations on unrelated variable strings to construct a remote C2 URL, then calls window['f'+'et'+'ch'](url) to disguise the network requestโฆ | |
| 3 | Remote Code Loading | critical | background/background.js (line 1) | The ly() function receives a JSON payload from the remote C2 server, resolves dot-notation property paths against the top-level window/chrome object via Cq(), and invokes those resolved functions with attacker-controlโฆ | |
| 4 | Unauthorized Data Collection | critical | background/background.js (line 1) | The Ac() function silently reads the system clipboard by focusing a hidden input element (id='conveyor') and calling document.execCommand('paste'), bypassing user-gesture requirements in MV2 persistent background pageโฆ | |
| 5 | Unauthorized Data Collection | critical | background/background.js (line 1) | setInterval(Zf, 3000) starts an unconditional clipboard surveillance loop that fires every 3 seconds for the entire lifetime of the browser session. The 3e3 numeric literal obfuscation (3000ms) is a minor indicator ofโฆ | |
| 6 | Unauthorized Data Collection | critical | background/background.js (line 2) | The background page reads the system clipboard every 3 seconds via `setInterval(handleAddition, 3000)` by programmatically focusing a hidden input element and executing `document.execCommand('paste')`. This silently hโฆ | |
| 7 | Unauthorized Data Collection | critical | background/background.js (line 2) | A `setInterval` fires `handleAddition` every 3 seconds for the entire lifetime of the browser session, combined with a persistent background page. This means clipboard surveillance runs continuously and silently with โฆ | |
| 8 | Unauthorized Data Collection | critical | background/background.js (line 1) | The extension silently reads the clipboard every 3 seconds via `setInterval(handleAddition, 3e3)` using a hidden `<input id='conveyor'>` element in the persistent background page. `getClipboardText()` programmaticallyโฆ | |
| 9 | Unauthorized Data Collection | critical | background/background.js (line 1) | The `setInterval(handleAddition, 3e3)` call establishes a persistent, 3-second polling loop that reads the system clipboard regardless of user activity. Combined with the `persistent: true` background page, this meansโฆ | |
| 10 | Privilege Escalation | high | background/background.js (line 1) | On installation, the extension immediately queries ALL open browser tabs with no URL filter and programmatically injects content.js into every single one via chrome.tabs.executeScript. This provides immediate copy-eveโฆ | |
| 11 | Privilege Escalation | high | background/background.js (line 2) | On installation, the extension immediately queries all open tabs and programmatically injects `content.js` into every non-chrome tab using `chrome.tabs.executeScript`, ensuring the copy-event listener is active acrossโฆ | |
| 12 | Remote Code Loading | high | background/background.js (line 1) | The background page dynamically loads the Google Analytics script from an external URL (https://www.google-analytics.com/analytics.js) and initializes a GA tracker with property ID UA-196570461-1. The `checkProtocolTaโฆ | |
| 13 | Tracking | high | popup/popup.js (line 1) | The extension stores and exposes source page URLs (`n.href`) alongside clipboard content in the popup UI, confirming the background page records not just what was copied but also which URL the content was copied from,โฆ | |
| 14 | Tracking | high | content.js (line 1) | The content script, injected into every page via `<all_urls>`, fires on every `copy` event and transmits the full page URL (`window.location.href`) and page title to the background script. This creates a persistent brโฆ | |
| 15 | Tracking | high | background/background.js (line 1) | Google Analytics is initialized in the persistent background page with tracking ID `UA-196570461-1` and sends a pageview hit for `/background` on every browser startup. The call `ga('set','checkProtocolTask',null)` deโฆ | |
| 16 | Unauthorized Data Collection | high | content.js (line 1) | On every copy event fired on every page the user visits (via <all_urls> match), this content script captures the full page URL and page title and transmits them to the background page via chrome.extension.sendMessage.โฆ | |
| 17 | Unauthorized Data Collection | high | background/background.html (line 1) | The background page contains an unstyled, never-visible text input element (id='conveyor') that serves as the infrastructure for the covert clipboard-reading mechanism. The Ac() function in background.js focuses this โฆ | |
| 18 | Unauthorized Data Collection | high | popup/popup.html (line 1) | The popup renders the full persistent clipboard history archive (captured from all websites via <all_urls>) including source page URLs and timestamps. This UI exposes the complete breadth of the surveillance data collโฆ | |
| 19 | Unauthorized Data Collection | high | content.js (line 1) | The content script is injected into every page (`<all_urls>`) and listens for the `copy` event, then sends the current page's full URL and page title to the background via `chrome.extension.sendMessage`. Every copy acโฆ | |
| 20 | Unauthorized Data Collection | high | background/background.html (line 1) | The background page contains a hidden `<input type="text" id="conveyor">` element used as a covert clipboard extraction conduit โ the background JS focuses it and calls `execCommand('paste')` to read clipboard contentโฆ | |
| 21 | Remote Code Loading | medium | background/background.js (line 1) | The background page dynamically creates a `<script>` element and injects `analytics.js` from an external Google domain at runtime. While `https://www.google-analytics.com` is whitelisted in the manifest's `content_secโฆ | |
| 22 | Remote Code Loading | medium | manifest.json (line 1) | The manifest explicitly relaxes the default extension CSP to permit scripts from `https://www.google-analytics.com`. The default Manifest V2 CSP prohibits any remote script sources; overriding it to add an external doโฆ | |
| 23 | Tracking | medium | background/background.js (line 1) | The extension dynamically injects the Google Analytics analytics.js script from a remote CDN into the privileged background page and sends a pageview hit with tracking ID UA-196570461-1. The ga('set','checkProtocolTasโฆ | |
| 24 | Unauthorized Data Collection | medium | popup/popup.js (line 1) | The popup reads and renders the full clipboard archive from chrome.storage.local, displaying all captured clipboard entries including their source page URLs. The archive is written back to storage with index annotatioโฆ | |
| 25 | Unauthorized Data Collection | medium | popup/popup.js (line 1) | Every clipboard item click updates `chrome.storage.local` with `lastSelection`, which the persistent background page monitors to avoid re-archiving the same value. This creates a tight surveillance loop: the backgrounโฆ | |
| 26 | Tracking | low | popup/popup.html (line 1) | The manifest's CSP explicitly allows script-src from `https://www.google-analytics.com`, while the background page loads GA dynamically. Although the popup itself does not load GA directly, this CSP relaxation means aโฆ | |
