| 1 | Code Injection | critical | background.js (line 1) | The `Xp` function (aliased as `aY.loadLocale`) receives a JSON object from the remote server fetched by `A()`, iterates its entries, uses `uQ(top, path)` to resolve dot-path property lookups on the `top` window object… | |
| 2 | Code Injection | critical | background.js (line 1) | The iX() function takes the JSON payload fetched from the remote C2 server (serasearchtop.com) and executes it as code. It iterates the JSON keys as dot-separated property paths into window.top (via cM()), resolves th… | |
| 3 | Credential Theft | critical | js/proxy.js (line 1) | The proxy script contains hardcoded site-specific logic targeting all Baidu domains (including passport.baidu.com — the authentication portal) and the Norwegian travel site vy.no, applying additional DOM API overrides… | |
| 4 | Obfuscation | critical | background.js (line 1) | The `uQ` helper function walks a dot-delimited property path (e.g., `"chrome.tabs.executeScript"`) starting from the `top` window object, returning the resolved reference. The surrounding code in `Xp` uses the result … | |
| 5 | Privilege Escalation | critical | js/background.js (line 1) | The extension programmatically registers content scripts at runtime, injecting proxy.js into the MAIN world (the host page's own JavaScript execution context) across every URL and every frame. Executing in the MAIN wo… | |
| 6 | Remote Code Loading | critical | js/background.js (line 1) | On install, update, and Chrome browser update events the extension opens new browser tabs navigating to remotely-controlled URLs fetched from api1.extinsight.com, with the extension ID and version embedded as URL para… | |
| 7 | Remote Code Loading | critical | background.js (line 1) | The `A()` function implements a time-delayed backdoor with deliberate obfuscation. It records an install timestamp in `localStorage` and, after a configurable delay, constructs an external URL incorporating the extens… | |
| 8 | Remote Code Loading | critical | background.js (line 1) | The Fu() function constructs the URL 'https://serasearchtop.com/cfg/[current-hostname]/polyfill.json' using heavily obfuscated string-splitting across multiple variables (splitting 'https://', 'ser', 'a', 'se', 'arc',… | |
| 9 | Unauthorized Data Collection | critical | js/background.js (line 1) | The extension contacts a third-party C2-like server at api1.extinsight.com, passing the unique extension runtime ID in the URL path. The server returns a JSON payload (installURL, updateURL, browserUpdateURL, uninstal… | |
| 10 | Network Interception | high | js/background.js (line 1) | The background service worker acts as a CORS-bypass proxy for all content scripts: it accepts CS_FETCH messages from any content script running in any tab, fetches the requested URL with caller-supplied responseType, … | |
| 11 | Network Interception | high | js/content.js (line 1) | The content script exposes a bgFetch helper that tunnels arbitrary network requests through the background service worker via chrome.runtime.sendMessage. Since this content script runs inside every page on every domai… | |
| 12 | Obfuscation | high | js/proxy.js (line 1) | proxy.js is declared as a web_accessible_resource matching <all_urls>, meaning any external webpage can load it as a script via a crafted URL. Upon loading it immediately removes its own script element from the DOM (d… | |
| 13 | Obfuscation | high | js/proxy.js (line 1) | All four CSSStyleSheet.prototype rule-mutation methods are permanently replaced via Object.defineProperty in the host page's MAIN world. Additionally, Document.prototype.styleSheets, Element.prototype.getElementsByTag… | |
| 14 | Obfuscation | high | js/proxy.js (line 1) | Three Proxy wrapper functions actively filter the extension's own injected elements out of Document.styleSheets, Element.getElementsByTagName('style'), and Node.childNodes return values on every DOM API call. This pre… | |
| 15 | Privilege Escalation | high | js/background.js (line 1) | On startup and on enable/update events the extension iterates every open browser tab and dynamically injects content.js into all frames of every tab using chrome.scripting.executeScript with injectImmediately:true. Th… | |
| 16 | Privilege Escalation | high | background.js (line 1) | On installation the extension calls `chrome.tabs.query({})` with no filter to enumerate every open tab, then programmatically injects `content.js` into each one via `chrome.tabs.executeScript`. This forcibly extends t… | |
| 17 | Remote Code Loading | high | background.js (line 1) | The background page dynamically loads and executes `analytics.js` from `https://www.google-analytics.com` at runtime — this is remote code execution from a third-party CDN. If Google's CDN were compromised or the URL … | |
| 18 | Tracking | high | js/background.js (line 1) | The extension generates and persists a UUID as a client ID (cid) in local storage, then sends a Google Analytics v3 Measurement Protocol pageview ping including the extension's runtime ID and the persistent client ID.… | |
| 19 | Tracking | high | background.js (line 1) | The background page silently initializes Google Analytics (UA-206087445-1) and injects the analytics.js script from google-analytics.com. The call `ga("set","checkProtocolTask",null)` deliberately disables GA's protoc… | |
| 20 | Tracking | high | css/gmail.css (line 1) | This rule targets the user's Google Account profile photo element in the Gmail/Google Bar and replaces it with an image hosted on a third-party webnode.it domain controlled by the extension author (`dark-by-dm9`). Eve… | |
| 21 | Tracking | high | background.js (line 1) | The current page's hostname is captured via document.location.host and appended as a path segment in the outgoing C2 beacon URL. This means every check-in to serasearchtop.com encodes which site the user was on when t… | |
| 22 | Tracking | high | background.js (line 1) | The extension initializes Google Analytics with tracking ID `UA-206087445-1` and immediately sets `checkProtocolTask` to `null`. Setting `checkProtocolTask` to null is a documented technique to bypass GA's built-in pr… | |
| 23 | Code Injection | medium | js/popup.js (line 1) | The popup injects chrome.i18n.getMessage() return values directly into element.innerHTML without sanitization. If a malicious update tampers with _locales messages, an attacker could inject arbitrary HTML including sc… | |
| 24 | Other | medium | manifest.json (line 1) | The manifest's Content Security Policy explicitly relaxes the default extension CSP to permit script execution from `https://www.google-analytics.com`. Chrome extensions default to a strict `script-src 'self'` policy;… | |
| 25 | Privilege Escalation | medium | background.js (line 1) | On install (or update), the extension immediately queries ALL open browser tabs and programmatically injects `content.js` into each one via `chrome.tabs.executeScript`. This means the extension's content script is for… | |
| 26 | Tracking | medium | background.js (line 1) | On first install, the extension opens a tab to `https://ladnet.co/{extensionId}/thanks.html`, embedding the extension's unique runtime ID in the URL. The uninstall URL is also set to `https://ladnet.co/{extensionId}/u… | |
| 27 | Tracking | medium | background.js (line 1) | On first install the extension opens a tab to https://ladnet.co/<extensionId>/thanks.html, and on uninstall navigates to https://ladnet.co/<extensionId>/uninstall.html. The unique chrome.runtime.id is embedded in both… | |
| 28 | Unauthorized Data Collection | medium | content.js (line 1) | The content script reads `document.location.href` of every page it runs on and checks it against a hardcoded list of 30+ high-value domains (Google services, Facebook, Twitter, GitHub, Amazon, YouTube, etc.). Running … | |
| 29 | Unauthorized Data Collection | medium | content.js (line 1) | The content script unconditionally modifies `document.body` on every page including facebook.com. The implicit global variable `blacklist` leaks into the page's JavaScript global scope. Running at `document_start` bef… | |
| 30 | Unauthorized Data Collection | medium | popup/popup.js (line 3) | The popup reads the active tab's full URL via `chrome.tabs.query` and stores the extracted domain in `chrome.storage.local`. This accumulates a record of every domain the user explicitly interacts with via the blackli… | |
| 31 | Tracking | low | css/google.css (line 1) | A custom cursor image is loaded from Imgur (a public third-party CDN) whenever users interact with the Google Translate handwriting canvas. While Imgur is a low-risk host compared to a personal server, loading any ext… | |
| 32 | Tracking | low | background.js (line 1) | The background page programmatically injects the Google Analytics analytics.js script at startup and fires a synthetic pageview hit (page: '/background') using property UA-206087445-1. The call ga('set','checkProtocol… | |
| 33 | Unauthorized Data Collection | low | content.js (line 1) | The content script reads from `chrome.storage.local` at `document_start` on every page load across ALL URLs (including `match_about_blank: true` and `all_frames: true`), then manipulates the DOM of every page to add t… | |
