| 1 | Data Exfiltration | high | js/apps.com.google.common.common.js (line 984) | Collected events (copy/paste/drop/upload/rename/share) are serialized as `sensor_data` payloads and forwarded to the background service worker via `runtime.sendMessage("process-events", ...)`. The ultimate egress endp… | |
| 2 | Other | high | js/worker.js (line 1) | The MV3 service worker entry point loads `background.js` via importScripts, but that file is not present in the extracted bundle. This means the core privileged background logic (which has tabs/cookies/webRequest/scri… | |
| 3 | Privilege Escalation | high | manifest.json (line 530) | The extension requests the `cookies` + `webRequest` + `scripting` + `management` + `<all_urls>` combination with document_start content scripts on ~40 authenticated SaaS hosts (Gmail, Drive, Docs, Office, SharePoint, … | |
| 4 | Tracking | high | manifest.json (line 35) | A document_start content script is injected into every URL (<all_urls>) in every frame including about:blank, paired with broad host_permissions and cookies/webRequest/scripting/management/tabs/downloads permissions. … | |
| 5 | Unauthorized Data Collection | high | js/apps.com.google.common.common.js (line 999) | Registers capture-phase listeners for copy/paste/drop/change on the document, recursively walks into every shadow root to attach the same listeners, and intercepts the clipboard API. Combined with the `<all_urls>` con… | |
| 6 | Unauthorized Data Collection | high | js/apps.com.office.index.js (line 851) | Enumerates and parses MSAL (Microsoft Authentication Library) localStorage keys — ts.userInfo, EwPreloadUserStorageId, sessionTracking_*, msal.account.keys, *.active-account — to harvest the signed-in Microsoft accoun… | |
| 7 | Unauthorized Data Collection | high | js/apps.com.reddit.index.js (line 851) | On every Reddit page load the content script silently fetches the private account settings page (reddit.com/settings/account) using the user's own session cookies and scrapes the email address out of the rendered sett… | |
| 8 | Code Injection | medium | js/apps.com.google.common.common.js (line 404) | Generic helper that injects a `<script>` element into the target page's DOM at document_start. The source is resolved via `chrome.runtime.getURL("js/...")` so it only loads code bundled inside the extension (not a rem… | |
| 9 | Code Injection | medium | js/apps.com.office.index.js (line 395) | Dynamically creates <script> elements and prepends them to documentElement to break out of the content-script isolated world and execute code in the page's MAIN world. The URL is resolved via chrome.runtime.getURL and… | |
| 10 | Credential Theft | medium | js/apps.com.google.mail.index.js (line 1406) | Checks document.cookie for the Google SAPISID session identifier to decide whether the user is authenticated to Google before injecting additional page-script surveillance. SAPISID is the sensitive Google auth cookie … | |
| 11 | Data Exfiltration | medium | manifest.json (line 532) | The CSP allow-lists 10 hard-coded high-numbered localhost ports over both HTTP and HTTPS for outbound connections. This implies the extension pipes collected telemetry/DLP data to a locally-running Cyberhaven sensor a… | |
| 12 | Network Interception | medium | js/apps.com.google.common.common.js (line 1429) | Reads `document.cookie` to detect a signed-in Google session (SAPISID), then injects a page-world script that hooks XHR in Google Drive/Docs/Mail to track file operations. Cookie-gated MAIN-world script injection that… | |
| 13 | Network Interception | medium | js/apps.com.live.index.js (line 903) | Uses a feature-flag cookie (`_ch_ff=1`) to conditionally enable proxies that intercept email attachments and sent-email events on Outlook. Cookie-gated activation of extra interception surfaces is suspicious because i… | |
| 14 | Network Interception | medium | js/apps.com.google.drive.drive.js (line 1429) | Checks for Google's SAPISID authentication cookie via document.cookie to detect a signed-in Google session, then injects an XHR-hooking script ("google_xhr") into the page. The hook intercepts Drive API XHR traffic. W… | |
| 15 | Network Interception | medium | manifest.json (line 541) | CSP whitelists ten hardcoded localhost ports (both http and https) for outbound connect-src from extension pages. This creates an off-browser IPC channel to a native companion binary; if any of those ports is hijacked… | |
| 16 | Tracking | medium | js/apps.com.live.index.js (line 888) | A hidden feature-flag cookie (_ch_ff=1) set in the browser toggles on additional monitoring channels — email attachments, sent emails, and a generic log proxy — from Outlook/Live pages. Cookie-gated feature flags let … | |
| 17 | Unauthorized Data Collection | medium | js/apps.com.microsoft.copilot.index.js (line 282) | Extracts the signed-in user's email/UPN by scraping Microsoft MSAL authentication entries out of localStorage (`.active-account`, `msal.account.keys`). Other branches in this file also read `ts.userInfo`, `EwPreloadUs… | |
| 18 | Unauthorized Data Collection | medium | js/apps.com.google.mail.index.js (line 857) | File upload interception: maps File objects (name, size, metadata) and sends them with current URL to the background service worker on every upload across Gmail and other cloud services. This is DLP-style broad file-m… | |
| 19 | Unauthorized Data Collection | medium | js/apps.com.box.index.js (line 473) | Clipboard (copy/paste) interception: every copy/paste event, including pageData context, is forwarded to the extension background worker across all matched sites. Legitimate DLP behavior but constitutes pervasive clip… | |
| 20 | Unauthorized Data Collection | medium | js/apps.com.github.index.js (line 1000) | Content script harvests authenticated account identity (email, username, account type) from page-level storage on GitHub and reports URL + title + metadata back to the extension backend. The same collector pattern (pr… | |
| 21 | Code Injection | low | js/apps.com.box.index.js (line 443) | Generic script-injection helper used to load web-accessible scripts (e.g. google_xhr, ch_page_data, dom_extras) into the MAIN world of monitored pages. Scripts are loaded from the extension bundle via chrome.runtime.g… | |
| 22 | Data Exfiltration | low | manifest.json (line 555) | Extension allows connect-src to ten hard-coded localhost ports over both http and https, in addition to Microsoft endpoints. This strongly implies an accompanying native/local agent that receives collected DLP telemet… | |
| 23 | Obfuscation | low | js/worker.js (line 1) | The MV3 service-worker entry point is a 7-line shim that importScripts('background.js'), but neither background.js nor browser-polyfill.min.js is present in the extracted bundle. The background worker is where cookies… | |
| 24 | Other | low | manifest.json (line 556) | The extension CSP whitelists ten hard-coded `http://localhost:<port>` and matching HTTPS endpoints for background `connect-src`. This indicates the extension speaks to a locally-installed companion agent over HTTP on … | |
