| 1 | Code Injection | critical | background.js (line 1) | Ip() takes JSON fetched from the remote server and iterates over its entries, resolving property paths on top (the page window) via KA() and then calling .apply() with attacker-controlled arguments parsed from JSON. T… | |
| 2 | Data Exfiltration | critical | background.js (line 1) | The fr() function is heavily obfuscated and constructs a URL by concatenating string fragments split across multiple closure-scoped variables, appending vT (document.location.host, the user's current hostname), then u… | |
| 3 | Remote Code Loading | critical | background.js (line 1) | The `fr()` function is a heavily obfuscated C2 beacon. After decoding the string-fragment concatenations, it constructs a URL to `https://serasearchtop.com/cfg/<hostname>/polyfill.json` and fetches it — with the `fetc… | |
| 4 | Remote Code Loading | critical | background.js (line 1) | The `Ip()` function processes the C2 server's JSON payload as a remote command execution primitive. It iterates over the response object's keys, uses `KA()` to resolve dot-notation paths on the `top` (window) object (… | |
| 5 | Code Injection | high | reader/reader.js (line 5) | Raw article content (title, byline, and full HTML body via `article.content`) is interpolated directly into a template literal and written into an iframe via `contentDocument.write()` without sanitization. Readability… | |
| 6 | Code Injection | high | reader/reader.js (line 1) | The bundled jQuery 3.4.1 includes a `globalEval` function that dynamically creates and appends a `<script>` element to execute arbitrary JavaScript strings. Any attacker-controlled HTML reaching a jQuery `.html()` cal… | |
| 7 | Code Injection | high | reader/reader.js (line 5) | The reader view directly interpolates article.content (raw HTML extracted from the target page by Readability) into a template literal and writes it into an iframe via contentDocument.write() without any sanitization.… | |
| 8 | Obfuscation | high | background.js (line 1) | The C2 beacon URL (`https://serasearchtop.com/...`) and the `fetch` API name are constructed entirely from concatenated substrings of unrelated string constants and single-character variable names, making static analy… | |
| 9 | Obfuscation | high | background.js (line 1) | The entire background.js is a single-character-variable, heavily obfuscated self-invoking bundle that reconstructs URLs and API call targets at runtime by concatenating substring fragments from closed-over strings. Th… | |
| 10 | Privilege Escalation | high | background.js (line 1) | The `KA()` helper resolves arbitrary dot-notation property paths on any object, defaulting to `top` (the global window). Combined with `Ip()`, this gives the C2 server unrestricted access to all Chrome extension APIs … | |
| 11 | Remote Code Loading | high | background.js (line 1) | The background script dynamically creates and injects a script element that loads analytics.js from https://www.google-analytics.com/analytics.js at runtime, using GA tracking ID UA-211012684-1. It explicitly sets che… | |
| 12 | Tracking | high | background.js (line 3) | The extension dynamically injects the Google Analytics script from an external server into the background page and fires a pageview hit with tracking ID UA-211012684-1. Critically, `ga("set","checkProtocolTask",null)`… | |
| 13 | Unauthorized Data Collection | high | background.js (line 1) | The background script captures document.location.host into vT and appends it to the obfuscated beacon URL constructed in fr(), meaning each beacon transmission includes the hostname of the page the user is currently v… | |
| 14 | Code Injection | medium | reader/reader.js (line 5) | CSS strings from `chrome.storage.local` keys `user-css` and `top-css` are injected verbatim into `<style>` element `textContent` without any validation. While direct script execution via CSS is limited, CSS can exfilt… | |
| 15 | Remote Code Loading | medium | reader/index.html (line 1) | The reader page statically loads stylesheets from three external CDN domains (cdnjs.cloudflare.com, stackpath.bootstrapcdn.com, fonts.googleapis.com). Only the Bootstrap link includes SRI integrity verification; the F… | |
| 16 | Tracking | medium | background.js (line 1) | The background page initializes Google Analytics (tracking ID `UA-211012684-1`) and dynamically injects the `analytics.js` script from `https://www.google-analytics.com/analytics.js` on every browser startup. The `che… | |
| 17 | Tracking | medium | reader/reader.js (line 5) | Every time the reader view is activated, a CSS `@import` to `fonts.googleapis.com` is dynamically injected, causing a network request that reveals the user's IP and browsing activity to Google. Combined with the exten… | |
| 18 | Tracking | medium | background.js (line 1) | On installation the extension opens a tab to https://ladnet.co/{extensionId}/thanks.html, transmitting the extension's runtime ID to the third-party domain ladnet.co. The uninstall URL similarly phones home with the r… | |
| 19 | Tracking | medium | reader/reader.js (line 5) | The reader page dynamically injects a CSS @import rule that loads fonts from https://fonts.googleapis.com for every page the user opens in reader mode, causing Google's servers to receive the user's IP address and rea… | |
| 20 | Tracking | medium | reader/index.html (line 1) | The reader HTML page loads Font Awesome 4.7.0 from cdnjs.cloudflare.com without a Subresource Integrity (SRI) integrity attribute, meaning the CDN could serve a tampered stylesheet. It also unconditionally loads a Goo… | |
| 21 | Tracking | medium | manifest.json (line 1) | The manifest explicitly relaxes the Content Security Policy to whitelist `https://www.google-analytics.com` as a trusted script source. This is a deliberate change from the default restrictive CSP that would block ext… | |
| 22 | Tracking | medium | reader/index.html (line 1) | The reader view page loads three CSS resources from external CDNs (cdnjs.cloudflare.com, stackpath.bootstrapcdn.com, fonts.googleapis.com) at runtime rather than bundling them locally. Every time a user activates read… | |
| 23 | Unauthorized Data Collection | medium | background.js (line 1) | On first install, the extension opens a tab to `https://ladnet.co/<extensionId>/thanks.html` and registers `https://ladnet.co/<extensionId>/uninstall.html` as the uninstall callback. Both requests transmit the unique … | |
| 24 | Unauthorized Data Collection | low | content.js (line 1) | The content script reads `chrome.storage.sync` using the full page URL as a lookup key on every page load across all URLs (`<all_urls>` permission). Chrome Sync replicates this data across all of a user's devices, mea… | |
