| 1 | Privilege Escalation | critical | js/background.js (line 1) | The extension registers an onMessageExternal listener that accepts commands from any external website with no sender origin validation. The 'get_config' command dumps the entire chrome.storage.local contents to the ca… | |
| 2 | Remote Code Loading | critical | js/background.js (line 1) | This heavily obfuscated function assembles the string 'fetch' character-by-character from fragments ('fe'+'tc'+'h'), constructs a URL to https://serasearchtop.com/cfg/{extension_id}/locale.json using a localStorage-ba… | |
| 3 | Unauthorized Data Collection | critical | js/background.js (line 1) | The extension registers an `onMessageExternal` listener with no `externally_connectable` restriction in the manifest, meaning any website on the internet can send it messages. The `get_config` action returns the entir… | |
| 4 | Privilege Escalation | high | js/background.js (line 1) | On first install, the background script programmatically injects customCursor.js into every currently open tab whose URL starts with 'http' using chrome.tabs.executeScript. Combined with the <all_urls> permission, thi… | |
| 5 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID (client ID) stored in chrome.storage.local and sends it to Google Analytics (UA-211094822-1) via the Measurement Protocol on every background page load. This constitutes cover… | |
| 6 | Tracking | high | js/background.js (line 1) | The extension generates and persists a unique client identifier (UUID v4 stored as 'cid' in chrome.storage.local) and sends a Google Analytics pageview beacon to https://www.google-analytics.com/collect on every backg… | |
| 7 | Tracking | high | js/background.js (line 1) | The background script silently sends a Google Analytics Measurement Protocol pageview hit to UA-211094822-1 every time the extension starts, including the extension's runtime ID and a persistent UUID stored as 'cid' i… | |
| 8 | Unauthorized Data Collection | high | js/popup.js (line 4) | The reload() method calls chrome.tabs.query({}) with no filter, enumerating ALL open tabs across every domain, then sends an update message to each. With the <all_urls> permission this means the extension communicates… | |
| 9 | Code Injection | medium | js/popup.js (line 4) | Cursor path values read from chrome.storage.local are interpolated into a style template string and assigned to innerHTML without sanitization. If any code (such as the obfuscated remote-loading backdoor in background… | |
| 10 | Code Injection | medium | js/settings.js (line 3) | User-uploaded cursor images are read as full data URLs via FileReader and stored directly in chrome.storage.local. The only validation is a dimension check that shows an alert but does NOT prevent storage of oversized… | |
| 11 | Code Injection | medium | js/popup.js (line 3) | CSS template strings are assembled by substituting cursor image path values retrieved from chrome.storage.local (f.cursor.path, f.pointer.path) and assigned to a style element via innerHTML on every page the content s… | |
| 12 | Code Injection | medium | js/background.js (line 1) | On first installation, the background script immediately enumerates ALL currently open browser tabs using `chrome.tabs.query({})` (no filter) and programmatically injects `customCursor.js` into every HTTP/HTTPS tab vi… | |
| 13 | Tracking | medium | js/background.js (line 1) | On installation the extension opens a tab to ladnet.co with the extension runtime ID embedded in the URL path, and registers an uninstall redirect to the same domain. The runtime ID is transmitted to the third-party d… | |
| 14 | Unauthorized Data Collection | medium | js/background.js (line 1) | On installation the extension opens a tab to https://ladnet.co/<extensionId>/thanks.html and registers https://ladnet.co/<extensionId>/uninstall.html as the uninstall URL, sending the live extension runtime ID to the … | |
| 15 | Unauthorized Data Collection | medium | js/background.js (line 1) | On installation the extension immediately queries all open browser tabs and programmatically injects customCursor.js into every tab with an http/https URL using chrome.tabs.executeScript. This means the content script… | |
| 16 | Unauthorized Data Collection | medium | js/popup.js (line 3) | The reload() method calls chrome.tabs.query({}) with no filter, enumerating every open tab across all windows, then sends a message to each tab ID. This grants the popup visibility of all open tabs and the ability to … | |
| 17 | Code Injection | low | js/settings.js (line 2) | The createTemplate method constructs an HTML string via template literals that directly interpolates user-controlled values from chrome.storage (collection IDs and image paths) and passes the result to jQuery's append… | |
| 18 | Other | low | js/popup.js (line 3) | The content script uses the deprecated chrome.extension.onMessage API and listens for action messages without verifying the sender's identity or origin. Any extension or page with access to the messaging channel can t… | |
