| 1 | Data Exfiltration | critical | js/content.js (line 1) | Based on settings fetched from the C2 server (`getsetting` → `http://an.xwhealthy.com/newNovel/frame`), the content script injects iframes into host pages. The iframe src is set to an operator-controlled URL with the … | |
| 2 | Network Interception | critical | js/background.js (line 1) | The background script registers a `tabs.onUpdated` listener (`A`) that intercepts every page navigation. When a tab loads, it checks the URL against per-domain (`u.ul`) and regex-based (`u.al`) redirect rule lists dow… | |
| 3 | Network Interception | critical | js/background.js (line 1) | The `C()` function accepts an array of rule objects from the C2 server and dynamically installs them as `declarativeNetRequest` rules at runtime. Since the rule content (action and condition) comes entirely from the r… | |
| 4 | Remote Code Loading | critical | js/background.js (line 1) | The extension hardcodes a remote C2 server at `an.xwhealthy.com` and contacts it at startup to download 'openNovel' redirect rules and 'frame' iframe injection settings. All responses are decoded with a custom obfusca… | |
| 5 | Remote Code Loading | critical | js/content.js (line 1) | On every page load, `appInit` sends the persistent user UUID (`uid`), extension version, and timestamp to `http://an.xwhealthy.com/newNovel` in exchange for dynamically updated `declarativeNetRequest` rules. If the se… | |
| 6 | Code Injection | high | js/content.js (line 265) | The content script requests HTML from the background script and injects the returned string directly into arbitrary web pages with `before()`/`after()`. The background handler for `getrd` fetches that content from a r… | |
| 7 | Code Injection | high | js/background.js (line 697) | The background message dispatcher will execute extension-packaged scripts or styles in the active tab when it receives an `insert` request. Combined with the unvalidated `postMessage` bridge in the content script, thi… | |
| 8 | Network Interception | high | js/background.js (line 571) | The extension accepts an encoded JSON blob and passes it into `b(a)`, which installs dynamic declarativeNetRequest rules. Elsewhere in the same file this blob is fetched from `https://an.xwhealthy.com/newNovel`, givin… | |
| 9 | Network Interception | high | rules.json (line 1) | A static `declarativeNetRequest` rule forces `Access-Control-Allow-Origin: *` on all responses from `an.xwhealthy.com`. This strips CORS protections so the extension's content scripts can freely make cross-origin requ… | |
| 10 | Obfuscation | high | js/background.js (line 1) | Module 776 implements a custom two-step obfuscation: characters from the input string are split by even/odd index position into two buckets, each bucket is individually reversed, then concatenated and base64-decoded. … | |
| 11 | Phishing | high | js/background.js (line 735) | This helper opens or replaces the current tab with a URL chosen from `e.u`. That URL list is driven by remotely loaded config (`c.ul`/`c.al` later in the file), so the extension can silently redirect users on matching… | |
| 12 | Privilege Escalation | high | js/content.js (line 349) | Any web page can send a `window.postMessage` with `from: "page"`, and the content script forwards it into `chrome.runtime.sendMessage` without validating origin or command type. This creates a privilege boundary bypas… | |
| 13 | Tracking | high | js/background.js (line 438) | This sends a telemetry payload to `https://an.xwhealthy.com/log.json`. The payload is built from `C()`, which includes the stored install identifier, browser type, extension version, and timestamp, enabling per-user a… | |
| 14 | Tracking | high | js/background.js (line 1) | On first run the extension generates a 32-character random hex UUID (`gid`) and persists it to `chrome.storage.local`. Every day, the `D()` function sends this UUID, the browser/extension identifier, the extension ver… | |
| 15 | Unauthorized Data Collection | high | js/content.js (line 1) | The content script's `d.init()` runs on every page and sends the full page URL (`window.location.href`, URL-encoded) along with the extension name to `http://an.xwhealthy.com/log/logcome` via a POST request. The domai… | |
| 16 | Tracking | medium | js/background.js (line 482) | The extension generates a persistent 32-character identifier and stores it in local extension storage. A stable per-install identifier is a common tracking primitive, especially when combined with broad host access an… | |
