| 1 | Code Injection | high | inboxsdk.js (line 378) | The `loadScript` function fetches a remote script via XHR and then evaluates its content using `eval()`, with `eval` aliased to variable `a` — a known technique to evade static analysis tools that flag direct `eval` c… | |
| 2 | Data Exfiltration | high | background.js (line 149) | The background script forwards the full list of links extracted from Gmail messages to the Dropbox server endpoint `/extension/check_links`, using `withCredentials: true` so cookies accompany the request. This means D… | |
| 3 | Privilege Escalation | high | background.js (line 117) | The background script listens for an `uninstall_self` message and responds by calling `chrome.management.uninstallSelf()` with no sender origin verification. Any web page or content script that can send a runtime mess… | |
| 4 | Remote Code Loading | high | inboxsdk.js (line 411) | The SDK dynamically loads a remote JavaScript file from `https://www.inboxsdk.com/build/platform-implementation.js` at runtime and executes it in the extension's context. This is a remote code loading pattern that all… | |
| 5 | Remote Code Loading | high | content.js (line 40) | InboxSDK.loadScript(DROPINS_URL) dynamically loads an external JavaScript file (https://www.dropbox.com/static/api/2/dropins.js) at runtime from a remote server directly into the Gmail page context. This is a remote c… | |
| 6 | Unauthorized Data Collection | high | background.js (line 149) | Links found in the user's Gmail messages are serialized and sent to https://www.dropbox.com/extension/check_links, allowing Dropbox to see all URLs present in the user's emails. The request is made with credentials, l… | |
| 7 | Unauthorized Data Collection | high | content.js (line 356) | The extension reads both the sender's email address and all recipient email addresses from every email message viewed. This constitutes unauthorized collection of email metadata (sender and all recipients) for every m… | |
| 8 | Unauthorized Data Collection | high | content.js (line 98) | For every email message viewed, the extension extracts all links from the email body via `message_view.getLinksInBody()` and sends them to the background page and ultimately to an external Dropbox API endpoint via `ge… | |
| 9 | Code Injection | medium | content.js (line 568) | The extension listens for `postMessage` events from an iframe and parses `JSON.parse(evt.data)` with only a parent-window relationship check rather than validating `evt.origin` against an explicit allowlist. If this o… | |
| 10 | Code Injection | medium | content.js (line 681) | The onboarding flyout HTML is constructed by concatenating `chrome.i18n.getMessage()` return values directly into an `innerHTML` assignment without sanitization. If any i18n message string contains HTML special charac… | |
| 11 | Data Exfiltration | medium | util.js (line 51) | The Util.log function packages user activity data including a persistent GUID, an opaque 'key' field (user email hash), and arbitrary 'extra' metadata, then routes it through the background page to be POSTed to Dropbo… | |
| 12 | Data Exfiltration | medium | inboxsdk.js (line 396) | Error telemetry including stack traces, session IDs, email hashes, app IDs, and the user's current Gmail origin is automatically POSTed to `https://www.inboxsdk.com/api/v2/errors`. This data exfiltration occurs silent… | |
| 13 | Privilege Escalation | medium | background.js (line 117) | The extension listens for an internal message 'uninstall_self' and will programmatically uninstall itself via chrome.management.uninstallSelf(). Content scripts running in Gmail pages can trigger self-uninstallation b… | |
| 14 | Tracking | medium | background.js (line 68) | On install or update, the extension generates and persists a unique GUID in local storage and transmits it with install/upgrade events and version information to a remote logging endpoint. This constitutes persistent … | |
| 15 | Tracking | medium | util.js (line 51) | The shared `Util.log` function serializes an arbitrary `extra` object alongside a persistent GUID and sends it to the background script for forwarding to an external Dropbox endpoint. Because `extra` accepts any objec… | |
| 16 | Tracking | medium | background.js (line 129) | The extension sends telemetry data including an event name, a persistent GUID, a 'key' field (SHA-1 hash of user's email), version, and arbitrary 'extra' JSON to https://www.dropbox.com/gmail_extension_log via POST wi… | |
| 17 | Tracking | medium | content.js (line 52) | The extension hashes the authenticated Gmail user's email address and stores it as `log_key`, which is then sent with every telemetry/logging call via `Util.log()`. While hashing provides pseudonymization, the SHA-1 h… | |
| 18 | Tracking | medium | content.js (line 64) | Every user interaction — including opening emails, clicking attachments, inserting links, and onboarding flows — is logged to an external endpoint via `Util.log()` with a persistent `log_guid` (from chrome.storage.loc… | |
| 19 | Tracking | medium | content.js (line 50) | The extension reads the authenticated Gmail user's email address via sdk.User.getEmailAddress() and immediately hashes it with SHA-1, storing the result as log_key. This hash is then transmitted alongside every analyt… | |
| 20 | Tracking | medium | background.js (line 129) | Every user interaction (file saves, link previews, attachment clicks, onboarding events) is POSTed to Dropbox's /gmail_extension_log endpoint with xhr.withCredentials = true, sending the email-derived SHA-1 hash (key)… | |
| 21 | Unauthorized Data Collection | medium | background.js (line 129) | Telemetry data including a persistent GUID, event names, keys, version, and an arbitrary `extra` field are posted to `/gmail_extension_log` on the Dropbox server with `withCredentials: true`. The `extra` field is pass… | |
| 22 | Unauthorized Data Collection | medium | constants.js (line 16) | A hardcoded SHA1 email hash blacklist is defined, indicating the extension hashes user email addresses and compares them against this list. This implies the extension collects and processes user email addresses, which… | |
| 23 | Unauthorized Data Collection | medium | constants.js (line 16) | A hardcoded SHA-1 hash blacklist for email addresses implies the extension hashes and processes user email addresses for every message viewed. This means the extension is systematically collecting and hashing PII (ema… | |
| 24 | Unauthorized Data Collection | medium | inboxsdk.js (line 393) | Error reports sent to `https://www.inboxsdk.com/api/v2/errors` include `emailHash` (derived from the user's Gmail address), `sessionId`, `extensionId`, `origin`, and stack traces. While hashed, the email address is st… | |
| 25 | Unauthorized Data Collection | medium | background.js (line 149) | When any email is opened containing Dropbox links, those full URLs are extracted from the email body and transmitted to Dropbox's /extension/check_links endpoint with credentials. This effectively reports to Dropbox w… | |
| 26 | Other | low | background.js (line 98) | The external message handler has a logic flaw: it only blocks requests where `sender.url` is present AND non-Dropbox, so requests with no URL (e.g., from service workers or certain contexts) pass the guard entirely. T… | |
| 27 | Other | low | content.js (line 3) | The content script injects the extension version number into the Gmail page's DOM as a `data-dropbox-version` attribute on `<head>`. Any JavaScript executing on the page, including third-party scripts loaded by Gmail,… | |
| 28 | Other | low | content.js (line 356) | Every email's full sender and all recipient addresses are hashed and checked against EMAIL_HASH_BLACKLIST (a hardcoded list containing the SHA-1 hash '8997f8f2a2469665e94ade58475c2f605a7a42de'). When matched, the exte… | |
| 29 | Tracking | low | chooser.js (line 16) | The Dropbox file chooser iframe is created with the current page's origin passed as a URL parameter to the Dropbox server, allowing Dropbox to track when the chooser is opened from within Gmail and associate it with s… | |
| 30 | Tracking | low | background.js (line 68) | On install or update, a persistent GUID is generated and stored locally, then transmitted to Dropbox servers along with install/update events and version information. This GUID serves as a unique persistent identifier… | |
| 31 | Tracking | low | isinstalled.js (line 4) | This content script injects a hidden DOM element into every page it runs on, exposing the extension's internal runtime ID (`chrome.runtime.id`) and exact version number as DOM attributes readable by any JavaScript on … | |
| 32 | Unauthorized Data Collection | low | isinstalled.js (line 4) | A hidden DOM element is injected into the Dropbox web page exposing the extension's internal runtime ID and version number via data attributes. Any JavaScript on the host page can read these values, enabling full exte… | |
