| 1 | Network Interception | critical | js/background.js (line 1) | The extension fetches the entire proxy server list from a remote third-party endpoint (https://api.nucleusvpn.com/api/proxy) at runtime, then routes ALL browser traffic through one of those servers. An attacker who coโฆ | |
| 2 | Network Interception | critical | js/popup.js (line 3) | The popup script fetches a server-controlled proxy list from api.nucleusvpn.com/api/proxy and configures PAC-script-based proxy settings that route all browser traffic through remote servers. The presence of this logiโฆ | |
| 3 | Network Interception | critical | js/background.js (line 1) | The extension fetches its entire proxy server list at runtime from a remote third-party API (`https://api.nucleusvpn.com/api/proxy`) and immediately applies one of those servers as the system-wide browser proxy. The `โฆ | |
| 4 | Network Interception | critical | js/background.js (line 1) | The full proxy server list is fetched dynamically from https://api.nucleusvpn.com/api/proxy at runtime, meaning the operator can change the proxy infrastructure at any time without a code update. Critically, the proxyโฆ | |
| 5 | Privilege Escalation | critical | js/background.js (line 1) | The extension sets a system-wide proxy (mode: fixed_servers) routing ALL browser traffic through a remotely-specified server, with the bypassList only exempting *api.nucleusvpn.com* โ meaning every other request (bankโฆ | |
| 6 | Code Injection | high | js/background.js (line 1) | On every tab creation and update, the background script injects a dynamically-constructed JavaScript code string into every web page via tabs.executeScript. The injected code uses insertAdjacentHTML to insert elementsโฆ | |
| 7 | Code Injection | high | js/background.js (line 1) | On every tab creation and update event, the background script injects JavaScript via tabs.executeScript into the active page that inserts a DOM element (an <img> tag sourced from the extension's web_accessible_resourcโฆ | |
| 8 | Code Injection | high | js/background.js (line 1) | Every new tab creation and every tab update triggers the `l()` function via `onCreated` and `onUpdated` listeners. This ensures JavaScript is injected into every page the user navigates to, not just pages they interacโฆ | |
| 9 | Code Injection | high | js/background.js (line 1) | The extension injects dynamically-constructed JavaScript strings into every website via `tabs.executeScript`. The injected code uses `insertAdjacentHTML('beforeBegin', ...)` to inject HTML containing extension-controlโฆ | |
| 10 | Network Interception | high | js/background.js (line 1) | During proxy health checks, the extension temporarily applies a PAC script to the entire browser (`scope: "regular"`) routing traffic through an unvalidated proxy server fetched from the remote API. This creates a 3-sโฆ | |
| 11 | Network Interception | high | js/background.js (line 1) | During proxy verification, the extension temporarily replaces the browser's entire proxy configuration with a PAC script that routes all ifconfig.me traffic through the candidate proxy while leaving all other traffic โฆ | |
| 12 | Network Interception | high | js/background.js (line 1) | When the VPN proxy is active, the extension explicitly exempts `api.nucleusvpn.com` from the proxy tunnel via `bypassList`. This means all communication between the extension and the VPN control server travels over thโฆ | |
| 13 | Obfuscation | high | js/content.js (line 1) | The content script is a complete Browserify module-loader bundle whose sole registered module (module 1) has an entirely empty function body. This is structurally anomalous: shipping a full module-loader infrastructurโฆ | |
| 14 | Remote Code Loading | high | js/background.js (line 1) | The extension dynamically fetches its full list of proxy servers from a remote API endpoint (`api.nucleusvpn.com/api/proxy`) at runtime. The operator can silently redirect all user traffic through any arbitrary serverโฆ | |
| 15 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID (stored as 'cid' in chrome.storage.local) and uses it as a Google Analytics client ID to send pageview beacon hits to https://www.google-analytics.com/collect with tracking IDโฆ | |
| 16 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID (`cid`) stored in `chrome.storage.local` and transmits it to Google Analytics (`https://www.google-analytics.com/collect`) with tracking ID `UA-208730755-1` on every backgrounโฆ | |
| 17 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID 'cid' stored in chrome.storage.local and, on every background script load, silently fires a Google Analytics Measurement Protocol pageview hit to UA-208730755-1 including the โฆ | |
| 18 | Tracking | high | js/background.js (line 1) | The extension silently generates a persistent UUID (stored as `cid` in chrome.storage.local) and sends it to Google Analytics (tracking ID UA-208730755-1) on every background page load. This creates a permanent cross-โฆ | |
| 19 | Unauthorized Data Collection | high | js/background.js (line 1) | During proxy verification, the extension temporarily sets a PAC-script proxy configuration and makes a live request to the third-party service https://ifconfig.me/ip, leaking the user's real or proxied IP address to tโฆ | |
| 20 | Unauthorized Data Collection | high | js/popup.js (line 3) | The popup's getIp function makes an outbound request to the third-party https://ifconfig.me/ip service to retrieve and display the user's IP address. Sending the user's IP to an external third-party service constituteโฆ | |
| 21 | Unauthorized Data Collection | high | html/popup.html (line 1) | The popup UI displays the user's IP address in a span populated by popup.js via a call to ifconfig.me, confirming live IP exfiltration to a third-party service on every popup open. The popup loads popup.js which contaโฆ | |
| 22 | Unauthorized Data Collection | high | js/background.js (line 1) | The background script registers listeners on every tab creation and every tab update event, then immediately calls tab-inspection function `l()` on each event โ enabling continuous surveillance of all browsing activitโฆ | |
| 23 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension sends the user's real IP address to the third-party service ifconfig.me on every connection-state check and each time the popup is refreshed (every 10 seconds via setInterval). For a VPN product, leakingโฆ | |
| 24 | Code Injection | medium | js/background.js (line 1) | On every tab creation and update event, the extension programmatically injects a JavaScript string into the active page via `tabs.executeScript`, which uses `insertAdjacentHTML('beforeBegin', ...)` to insert an HTML eโฆ | |
| 25 | Code Injection | medium | css/content.css (line 1) | This stylesheet styles the .genus-vpn-status element that is injected via tabs.executeScript into every HTTP/HTTPS page the user visits. The element is positioned fixed with a high z-index, visually overlaying contentโฆ | |
| 26 | Code Injection | medium | manifest.json (line 1) | The content script is declared with `run_at: document_start`, `all_frames: true`, and `match_about_blank: true`, meaning it executes on every frame of every page (including about:blank) before any page content loads. โฆ | |
| 27 | Network Interception | medium | js/popup.js (line 1) | The popup continuously polls the background script every 10 seconds via `sendMessage({action:"proxylist"})`, keeping the proxy server list synchronized from the remote API and updating the displayed connection state. โฆ | |
| 28 | Obfuscation | medium | js/content.js (line 1) | The content.js file is a minified/obfuscated Browserify module wrapper injected into all web pages (http://*/* and https://*/*) at document_start with all_frames:true and match_about_blank:true, yet contains only an eโฆ | |
| 29 | Tracking | medium | js/background.js (line 1) | By injecting a web_accessible_resources image into every webpage the user visits, any website can probe for the presence of chrome-extension://lpejglcfpkpbjhmnnmpmmlpblkcmdgmi/web_accessible_resources/status_on.png toโฆ | |
| 30 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension continuously retrieves the user's real public IP address from the third-party service `https://ifconfig.me/ip` and stores the result. Combined with the persistent UUID tracking and tab monitoring, this eโฆ | |
