| 1 | Data Exfiltration | critical | background.js (line 1) | Every alarm tick (every minute) the service worker harvests the title and URL of the user's active tab and POSTs them, encoded with `btoa(encodeURIComponent(...)).reverse()`, to the attacker-controlled C2 (`safemart.c… | |
| 2 | Privilege Escalation | critical | js/scripts/s-content.js (line 1) | Search hijacking with obfuscated host targets. Each numeric string in `t` is the concatenated char codes of a search-engine hostname (decoded: 'www.google.com', 'yandex.ru', 'duckduckgo.com', 'www.bing.com'). When the… | |
| 3 | Privilege Escalation | critical | background.js (line 1) | The C2 returns `{ url, images, blur, additionalUrls }` and the extension immediately fires GETs to every tracking pixel in `images`, then either silently navigates a hidden muted tab to the attacker-supplied URL or re… | |
| 4 | Privilege Escalation | critical | scripts/handlers/replacer.js (line 1) | The content script enumerates every Google ad container on every page, asks the C2's `/banner` endpoint for replacement creative, downloads the image (via the background to bypass page CORS), and replaces the legitima… | |
| 5 | Privilege Escalation | critical | js/scripts/content.js (line 1) | On any web page the content script silently registers a one-shot body click listener that, on the user's next click anywhere on the page, opens an attacker-supplied URL in a new tab. There's also a timeout path that o… | |
| 6 | Remote Code Loading | critical | background.js (line 1) | `fetchData()` retrieves an arbitrary HTML payload from the `/floki` endpoint on the attacker's C2 domain and forwards it to a content script, which inserts it into the active page's DOM via `insertAdjacentHTML`. This … | |
| 7 | Remote Code Loading | critical | background.js (line 1) | Daily 'checker' alarm contacts `/priest` on the C2 and writes the response body directly into `chrome.storage.sync.url`. That stored URL is later used by `s-content.js` as the redirect target for hijacked search queri… | |
| 8 | Obfuscation | high | js/scripts/s-content.js (line 2) | Hostname allow-list is intentionally obfuscated as concatenated decimal char codes ('www.google.com', 'yandex.ru', 'duckduckgo.com', 'www.bing.com') and the current tab's hostname is encoded the same way before compar… | |
| 9 | Privilege Escalation | high | background.js (line 1) | On install the extension uses `chrome.scripting.executeScript` to inject its content scripts into every tab the user already has open across all origins (host_permissions `<all_urls>`), bypassing the normal document_s… | |
| 10 | Privilege Escalation | high | scripts/handlers/replacer.js (line 1) | `replaceAds` is scheduled to run on an indefinite cascading interval (every 1s, 2s, 5s, then 15s for ~2.7 hours) on every page the user visits. The persistent re-scan ensures dynamically inserted Google ad slots are a… | |
| 11 | Privilege Escalation | high | js/scripts/content.js (line 1) | After force-navigating a tab to the attacker's URL, the extension overlays the destination page with a full-viewport `backdrop-filter: blur(25px)` div at `z-index 2147483647` and forcibly demotes any other element's z… | |
| 12 | Tracking | high | background.js (line 1) | On install, the extension fingerprints the user (UA, languages, timezone, app/version, app id, cookies, viewport, chrome web store referrer query) and exfiltrates the bundle to `safemart.click/sub/event`. The receivin… | |
| 13 | Unauthorized Data Collection | high | background.js (line 1) | On install the extension reads ALL cookies for the affiliate-tracking subdomain `tds.safemart.click`, normalizes the special `data` cookie name, and concatenates every cookie name/value into the install payload that i… | |
| 14 | Obfuscation | medium | background.js (line 1) | Custom `encode()` wraps payloads as `reverse(btoa(encodeURIComponent(x)))` before sending to the C2. This is not encryption — it provides no confidentiality but defeats casual log inspection and signature scanning of … | |
| 15 | Tracking | medium | background.js (line 1) | `chrome.runtime.setUninstallURL` is configured to open the C2's `/sub/event?type=uninstall` URL with the user's persistent `subid` (uuid) and partner attribution string, ensuring the attacker is notified — and the use… | |
