Custom Cursor Pack

Any external website that knows the extension ID (publicly available as kmjaecainjoaomeebaofnnbobomfigoa) can call get_config to exfiltrate all local storage or set_config to overwrite any storage key with no origin check, no secret, and no user confirmation. This is a fully open remote-control API. The set_config path allows an attacker-controlled site to write arbitrary values to selected.cursor.path, which is later rendered unsanitized into page CSS via customCursor.js.

chrome.runtime.onMessageExternal.addListener(function(t, e, i) {  if (t.action == "getInstalled") {    return i({      collections: this.collection,      ver: chrome.runtime.getManifest().version,      action: "get_installed_collection"    })  }  if (t.action == "get_config") {    chrome.storage.local.get(null, function(t) {      return i(t)    }.bind(this))  }  if (t.action == "set_config") {    chrome.storage.local.set(t.data);    return i({      status: true    })  }  if (t.action == "set_config_sync") {    chrome.storage.sync.set(t.data);    return i({      status: true    })  }  if (t.action == "get_config_sync") {    return i(this.config_sync)  }}.bind(this))

selected.cursor.path and selected.pointer.path are interpolated directly into a multi-selector CSS block via string replacement and then written to sheet.innerHTML without sanitization. Because set_config (bg.js:18521) lets any external website overwrite selected.cursor.path, an attacker can inject arbitrary CSS into every page the user visits, enabling UI redressing, CSS-based data exfiltration (e.g., input value exfiltration via attribute selectors), and phishing overlays.

tmpCss = tmpCss.replace(/#cursor#/g, selected.cursor.path);tmpCss = tmpCss.replace(/#size#/g, sizeNumber);tmpCss = tmpCss.replace(/#cursorOffsetX#/g, 0);tmpCss = tmpCss.replace(/#cursorOffsetY#/g, 0);tmpCss = tmpCss.replace(/#pointer#/g, selected.pointer.path);tmpCss = tmpCss.replace(/#size#/g, sizeNumber);tmpCss = tmpCss.replace(/#pointerOffsetX#/g, 0);tmpCss = tmpCss.replace(/#pointerOffsetY#/g, 0);sheet.innerHTML = tmpCss;

The 456KB background script bundles the full RxJS reactive-programming library (~10,000 lines) which is never used by the background class or any other extension file. Combined with CSP whitelisting google-analytics.com and googletagmanager.com where no analytics code exists, this pattern is consistent with a prior version that had additional functionality (tracking, exfiltration pipeline) that was stripped after CWS detection, leaving library dead-code and a prepared CSP behind.

// Lines 1-16111: jQuery 3.5.1 (~5600 lines) + full RxJS bundle (~10500 lines)// Neither library is referenced anywhere in the background class (lines 18316-18563)// The background class uses only native Chrome APIs and Promises.e.fetch = Mn; // RxJS fetch export — line 16050// ...const listOfCollection = {  ...} // cursor data starts line 16112class background {  ...} // actual extension code at line 18316