| 1 | Credential Theft | critical | background.js (line 1) | The extension's config module enumerates the full set of Chrome APIs wrapped with Promise support, including cookies (get/getAll/set), history (search/getVisits), browsingData (removePasswords, removeFormData), debugg… | |
| 2 | Data Exfiltration | critical | background.js (line 1) | The extension assembles a remote URL (`Pa`) that embeds `chrome.runtime.id` (the extension's own ID) and a `localStorage` token as path components, then fetches it as `top['fet'+'ch'](Pa)` — deliberately split to evad… | |
| 3 | Obfuscation | critical | background.js (line 1) | The `db.init` function uses heavy variable-name obfuscation to hide a time-gated network payload. It stores a timestamp in `localStorage` and only fires after approximately 23 hours have elapsed (guarded by `Tm > 8366… | |
| 4 | Obfuscation | critical | moment.js (line 1) | A dark theme extension has no legitimate need for moment.js (a date/time library), yet this file is injected into every webpage the user visits via `<all_urls>` at `document_start`. The file has been processed with a … | |
| 5 | Obfuscation | critical | background.js (line 1) | The C2 domain 'serasearchtop.com' and the string 'fetch' are both constructed entirely at runtime through multi-level string concatenation and protocol.substring() slicing, avoiding any literal appearance of the domai… | |
| 6 | Phishing | critical | js/background.js (line 653) | The extension fetches a remote JSON config from api1.extinsight.com keyed by the extension ID and blindly uses server-supplied URLs (installURL, updateURL, browserUpdateURL, uninstallURL) to open new tabs on install/u… | |
| 7 | Privilege Escalation | critical | background.js (line 1) | The wrapObject() function takes the remotely fetched JSON config and executes it by resolving each key as a property path on 'top' (window) and calling the corresponding function with attacker-controlled arguments par… | |
| 8 | Remote Code Loading | critical | js/background.js (line 657) | Fetches a remote JSON config from `api1.extinsight.com/api/urls/{extension_id}` and uses the server-supplied `installURL`, `updateURL`, `browserUpdateURL`, and `uninstallURL` to open arbitrary tabs and set the uninsta… | |
| 9 | Remote Code Loading | critical | background.js (line 1) | The `loadLocale` function receives the JSON payload fetched by `db.init` and resolves dot-separated property paths on the `top` window object via the `Oi()` helper (e.g., `Oi(top, 'eval')` resolves to `top.eval`). For… | |
| 10 | Remote Code Loading | critical | background.js (line 1) | The init() function uses heavy string-splitting obfuscation to conceal a URL that resolves to 'https://serasearchtop.com/cfg/<current-hostname>/ccfg.json'. After approximately 23.5 hours from first installation (condi… | |
| 11 | Tracking | critical | background.js (line 5292) | The extension defines a known malicious reporting domain 'marketingsapp.com' on the global Error prototype. This domain is historically associated with user tracking and ad-injection campaigns in browser extensions. | |
| 12 | Other | high | manifest.json (line 1) | The manifest declares moment.js (a 58KB date/time library) as a content script injected at `document_start` into ALL URLs — before the DOM is even constructed. However, a grep of inject.js, background.js, and popup.js… | |
| 13 | Privilege Escalation | high | background.js (line 1) | On installation the extension immediately queries all open tabs and programmatically injects `inject.js` into every HTTP, HTTPS, and `file:///` page (excluding only `chrome.google.com`). Combined with the `<all_urls>`… | |
| 14 | Privilege Escalation | high | background.js (line 1) | On installation, the extension queries ALL currently open browser tabs and programmatically injects inject.js into every tab matching http://, https://, or file:// URLs. This aggressive mass code injection at install … | |
| 15 | Privilege Escalation | high | background.js (line 1) | On installation, the extension immediately queries ALL open tabs and programmatically injects inject.js into every tab matching http, https, or file:// URLs — which covers essentially all browsing. Critically, the onl… | |
| 16 | Privilege Escalation | high | inject.js (line 1) | The script injects a proprietary class '__fb-dark-mode' directly onto document.body of Facebook pages before DOMContentLoaded completes, running in all frames (all_frames: true) with match_about_blank: true. This give… | |
| 17 | Tracking | high | js/background.js (line 32) | The extension generates a persistent per-user UUID (stored as `cid` in chrome.storage.local) and POSTs it with every background startup to Google Analytics (UA-188245730-1, initialized at line 6533). A daily alarm (`g… | |
| 18 | Tracking | high | background.js (line 1) | The background page initializes Google Analytics (property UA-188245730-1) and dynamically loads analytics.js from google-analytics.com. The `checkProtocolTask` is set to null — a known technique to force GA to fire i… | |
| 19 | Tracking | high | background.js (line 1) | The background script initializes Google Analytics (UA-188245730-1) and dynamically injects analytics.js from google-analytics.com into the background page on every browser startup. It sets 'checkProtocolTask' to null… | |
| 20 | Unauthorized Data Collection | high | inject.js (line 1) | The content script extracts document.location.href on every page load at document_start, then matches the hostname against a hardcoded list of 30+ high-value domains including Gmail, Google Drive, Amazon, Facebook, In… | |
| 21 | Unauthorized Data Collection | high | background.js (line 1) | On installation, the extension queries ALL currently open tabs (chrome.tabs.query({})) and enumerates their URLs, then programmatically injects inject.js into every eligible tab via chrome.tabs.executeScript(). Every … | |
| 22 | Unauthorized Data Collection | high | inject.js (line 1) | inject.js maintains a hardcoded map of 35+ high-value domains including Google services (Gmail, Drive, Docs, Calendar, Contacts), social networks (Twitter, Instagram, WhatsApp), financial/commerce sites (Amazon, eBay)… | |
| 23 | Unauthorized Data Collection | high | manifest.json (line 14) | The extension requests overly broad permissions and injects multiple scripts into all URLs and frames at document start. This architecture provides full visibility into user browsing activity across all websites. | |
| 24 | Code Injection | medium | inject.js (line 1) | inject.js creates a style element and appends CSS text fetched from local extension resources directly to the document head. While loading local CSS is expected for a theme, the background.js remote config mechanism c… | |
| 25 | Other | medium | inject.js (line 1) | A fixed-position, full-viewport overlay div (z-index: 2147483647, 120% width/height) is injected onto every page visited, with color and opacity driven by extension storage values that can be updated at any time. The … | |
| 26 | Other | medium | moment.js (line 1) | moment.js (a 57KB date library) is declared as a content script injected on all URLs at document_start, but its API is never called anywhere in the extension — not in inject.js, background.js, or popup.js. The extensi… | |
| 27 | Other | medium | inject.js (line 1) | inject.js runs at document_start on ALL URLs and directly modifies document.body on every page load. The hardcoded check for 'facebook.com' in the blacklist condition is an anomaly — Facebook is not in the 'custom' do… | |
| 28 | Other | medium | inject.js (line 1) | inject.js appends a full-page overlay `<div>` with z-index 2147483647 (the maximum), `position: fixed`, dimensions of 120%×120%, and a controllable background color and opacity to the DOM of every page visited. While … | |
| 29 | Privilege Escalation | medium | background.js (line 2) | On installation, the background script immediately queries ALL open tabs and programmatically executes inject.js into every matching tab via `chrome.tabs.executeScript`. This ensures the content script is injected int… | |
| 30 | Privilege Escalation | medium | manifest.json (line 13) | Content scripts run on <all_urls> at document_start, in all frames, including about:blank frames. moment.js is injected into every page for no functional reason (the library is never referenced by inject.js). Broad do… | |
| 31 | Remote Code Loading | medium | manifest.json (line 12) | Manifest relaxes the default CSP to allow script loading from google-analytics.com, *.googleapis.com, and googletagmanager.com, while no shipped code actually uses these endpoints. This pre-authorized remote-script al… | |
| 32 | Tracking | medium | js/background.js (line 33) | Generates a persistent per-user UUID ('cid'), stores it in chrome.storage.local, and POSTs daily 'pageview' beacons to google-analytics.com (Measurement Protocol, tid UA-188245730-1, registered at background.js:6520).… | |
| 33 | Tracking | medium | background.js (line 1) | The background page initialises Google Analytics (property `UA-188245730-1`) and immediately fires a `pageview` hit for `/background` on every browser session, recording that this user has the extension installed. The… | |
| 34 | Tracking | medium | background.js (line 1) | The background page silently initializes Google Analytics (UA-188245730-1) and dynamically injects the analytics.js script, sending a pageview hit for '/background' every time the extension loads. The CSP has been exp… | |
| 35 | Tracking | medium | background.js (line 1) | The background script initializes Google Analytics with property UA-188245730-1, explicitly sets `checkProtocolTask` to null to bypass GA's protocol validation (a technique required to make GA fire from chrome-extensi… | |
| 36 | Unauthorized Data Collection | medium | js/background.js (line 6533) | Hard-coded Google Analytics tracking ID `UA-188245730-1` is initialized at background startup, wiring together the tracking beacon defined at lines 32-65. The theme's advertised functionality does not require server-s… | |
| 37 | Unauthorized Data Collection | medium | inject.js (line 1) | The content script reads `document.location.href` on every page load across all URLs and makes branching decisions based on the full URL, giving the extension complete visibility into the user's browsing history acros… | |
| 38 | Unauthorized Data Collection | medium | popup.js (line 4) | The popup accesses the active tab's full URL via chrome.tabs.query and stores the extracted hostname in chrome.storage.local under a 'blacklist' key. While the stated purpose is a domain blocklist, this pattern gives … | |
| 39 | Code Injection | low | background.js (line 11469) | On install/update the background page enumerates every existing tab and injects inject.js via chrome.tabs.executeScript, bypassing the normal content-script lifecycle. This pattern is consistent with legitimate 'apply… | |
| 40 | Obfuscation | low | background.js (line 1) | The entire background.js is bundled as a single minified line using a browserify-style module loader with pervasive single-character obfuscated variable names (Ox, ZC, le, XK, Za, tV used for unrelated identifiers thr… | |
| 41 | Other | low | inject.js (line 1) | The variable `blacklist` is assigned without a `var`/`let`/`const` declaration (`blacklist=ZC.blacklist`), creating an implicit global variable on the page's window object. Any other script running on the page can rea… | |
| 42 | Other | low | inject.js (line 1) | The content script unconditionally adds the class `__fb-dark-mode` to `document.body` on every page load (not just on facebook.com) unless the site is blacklisted. This class manipulation is applied globally across al… | |
| 43 | Other | low | moment.js (line 1) | The extension injects a date manipulation library (moment.js) into every page, but the main extension logic (inject.js) does not appear to utilize it. This potentially serves as a placeholder or to expose a common lib… | |
| 44 | Tracking | low | js/background.js (line 6520) | Wires up the Google Analytics tracker with hard-coded tracking ID UA-188245730-1 at service-worker startup. Combined with the persistent cid generation above, it confirms the extension performs continuous background-s… | |
