| 1 | Code Injection | high | lib/jquery.jeditable.js (line 368) | The select content handler uses eval() to parse a JSON string returned from a server-controlled loadurl endpoint. Any server response or attacker-influenced content reaching this code path is executed as arbitrary Javโฆ | |
| 2 | Credential Theft | high | js/utils.js (line 18) | When a block rule is added, chrome.cookies.getAll({}) is called with an empty filter, which retrieves every cookie from every domain in every cookie store. This is a broad credential sweep โ every session token, auth โฆ | |
| 3 | Credential Theft | high | devtools/background-devtools.js (line 36) | The background devtools page retrieves all cookies for an inspected tab URL and relays the full cookie array โ including session tokens, HttpOnly cookies, and secure cookies โ via a port message to the devtools panel โฆ | |
| 4 | Credential Theft | high | devtools/background-devtools.js (line 13) | The background page accepts arbitrary cookie modification commands from the devtools panel via message passing โ deleting existing cookies and setting new ones for any URL โ with no authentication or origin check beyoโฆ | |
| 5 | Credential Theft | high | options_pages/user_preferences.js (line 222) | The function calls `chrome.cookies.getAll({})` with an empty filter, which retrieves ALL cookies across ALL domains in the browser, then iterates and modifies every cookie's expiration date. This is the broadest possiโฆ | |
| 6 | Data Exfiltration | high | lib/jquery.jeditable.js (line 266) | When a cookie field form is submitted via jEditable, it POSTs cookie data (including name, value, domain) to settings.target and writes the raw server response to self.innerHTML without sanitization. The target URL isโฆ | |
| 7 | Network Interception | high | js/background.js (line 111) | The extension installs a blocking webRequest listener on all URLs (<all_urls>) with extraHeaders access, meaning it intercepts every single HTTP and HTTPS response the browser receives across all websites. The listeneโฆ | |
| 8 | Network Interception | high | js/background.js (line 111) | A blocking webRequest listener intercepts all HTTP responses across every URL (<all_urls>) and can strip Set-Cookie response headers before they reach the browser. The blocking + extraHeaders flags grant the ability tโฆ | |
| 9 | Network Interception | high | js/background.js (line 111) | A blocking `webRequest.onHeadersReceived` listener intercepts ALL HTTP responses across all URLs and reads raw `Set-Cookie` header values โ including cookie names, values, and domains โ before the browser processes thโฆ | |
| 10 | Network Interception | high | js/background.js (line 158) | The `webRequest` listener is registered with `blocking` + `extraHeaders` on `<all_urls>`, granting access to otherwise-protected headers including `Set-Cookie` for every HTTP/HTTPS request in the browser. The `extraHeโฆ | |
| 11 | Remote Code Loading | high | js/ga.js (line 6) | The background page dynamically loads and executes a remote JavaScript file from ssl.google-analytics.com at runtime. The background page runs with elevated Chrome extension privileges including access to chrome.cookiโฆ | |
| 12 | Remote Code Loading | high | js/ga.js (line 6) | The GA analytics script is fetched and executed at runtime from an external server by dynamically injecting a script tag into the background page. The actual code executed is not contained within the extension packageโฆ | |
| 13 | Remote Code Loading | high | js/ga.js (line 1) | The extension dynamically injects an external script from `https://ssl.google-analytics.com/ga.js` into the popup page at runtime using `document.createElement('script')`. This constitutes remote code loading โ any coโฆ | |
| 14 | Remote Code Loading | high | popup.html (line 19) | The popup HTML loads `ga.js` which dynamically fetches and executes a remote Google Analytics script in the same execution context as the popup, which has access to `chrome.cookies`, `<all_urls>`, and all other privilโฆ | |
| 15 | Remote Code Loading | high | js/ga.js (line 1) | The extension dynamically injects a remote script from Google Analytics into its background context. Remote script loading is a high-risk pattern in extensions because the fetched code executes inside a privileged extโฆ | |
| 16 | Tracking | high | js/ga.js (line 1) | This file is loaded as the last entry in the background page script array (manifest.json lines 23-31), meaning it runs persistently in a privileged extension context with access to the cookies API. It dynamically injeโฆ | |
| 17 | Unauthorized Data Collection | high | js/ga.js (line 1) | Google Analytics is loaded dynamically in the background page โ a context with no UI and no user-initiated pageviews โ and fires a 'Heartbeat' event every 4 minutes as a persistent beacon confirming the extension is aโฆ | |
| 18 | Unauthorized Data Collection | high | devtools/panel.js (line 4) | A persistent message channel is established between the devtools panel and the background page on load, immediately requesting all cookies for the inspected tab. The devtools panel operates in a privileged context witโฆ | |
| 19 | Code Injection | medium | lib/i18n_translator.js (line 7) | The localizePage function uses jQuery's .html() to inject translated strings and i18n_argument attribute values into the DOM without sanitization. If any translated message string or attribute value contains HTML markโฆ | |
| 20 | Code Injection | medium | js/options_main_page.js (line 1) | The `element` variable is set directly from the `page` URL query parameter or from `localStorage` without any whitelist validation before being concatenated into `location.href`. An attacker who can control the URL paโฆ | |
| 21 | Code Injection | medium | lib/i18n_translator.js (line 7) | The `localizePage` function inserts translated strings via jQuery's `.html()` setter โ equivalent to `innerHTML` assignment โ without sanitization. If a locale message file were tampered with (the extension bundles 40โฆ | |
| 22 | Credential Theft | medium | js/popup.js (line 309) | The `importCookies` function accepts arbitrary JSON text pasted by the user and directly calls `chrome.cookies.set()` on each parsed cookie object without domain validation or sanitization. A crafted JSON payload coulโฆ | |
| 23 | Other | medium | js/options_main_page.js (line 1) | The options page reads the 'page' parameter directly from the URL query string via getUrlVars() and uses it unsanitized to construct a redirect target via location.href. This is an open redirect vulnerability โ a maliโฆ | |
| 24 | Other | medium | options_pages/options_page_chooser.js (line 6) | The options page opens URLs to editthiscookie.com over plain HTTP (not HTTPS), exposing users to MITM attacks on those navigations. The id attribute from DOM elements is also directly interpolated into a navigation paโฆ | |
| 25 | Other | medium | js/utils.js (line 106) | User-supplied filter strings (domain, name, value) are passed directly to new RegExp() without sanitization, creating a ReDoS (Regular Expression Denial of Service) vulnerability. A pathological regex in a cookie valuโฆ | |
| 26 | Other | medium | js/utils.js (line 106) | User-supplied filter rule strings (domain, name, value) are passed directly into `new RegExp()` without sanitization or escaping. This function is called inside the blocking `webRequest` handler, so a catastrophicallyโฆ | |
| 27 | Tracking | medium | js/ga.js (line 12) | A heartbeat event fires every 4 minutes from the background page to Google Analytics, continuously reporting to a third-party server that the user's browser is open and the extension is active. This leaks behavioral/pโฆ | |
| 28 | Tracking | medium | js/ga.js (line 1) | The extension silently tracks every popup open as a page view and fires a heartbeat telemetry event every 4 minutes to Google Analytics account `UA-33054271-5`, allowing the extension operator to monitor the precise uโฆ | |
| 29 | Tracking | medium | js/ga.js (line 1) | This code enables telemetry by sending a pageview and a recurring 'Heartbeat' event every 4 minutes to a Google Analytics property. It does not appear to send cookie contents directly, but it does implement persistentโฆ | |
| 30 | Unauthorized Data Collection | medium | js/background.js (line 46) | The background page registers a persistent listener on chrome.cookies.onChanged that fires for every cookie set or removed across all websites the user visits. On each event, it extracts the cookie name, domain, and fโฆ | |
| 31 | Unauthorized Data Collection | medium | js/background.js (line 46) | A global chrome.cookies.onChanged listener fires on every cookie change across all browsing contexts, reading the cookie name, domain, and value for each event. While ostensibly for a read-only cookie protection featuโฆ | |
| 32 | Unauthorized Data Collection | medium | devtools/panel.js (line 34) | The panel directly calls chrome.cookies.getAll() for any URL, retrieving all cookies associated with that origin including session tokens and auth cookies. Retrieved cookies are stored in module-level variables (tabURโฆ | |
| 33 | Unauthorized Data Collection | medium | js/background.js (line 46) | The `chrome.cookies.onChanged` listener captures the name, domain, and value of every cookie change event across all domains in real time. The extension has unrestricted access to all cookie values โ including sessionโฆ | |
| 34 | Credential Theft | low | js/cookie_helpers.js (line 140) | The cookie serialization functions (json, semicolonPairs, Netscape format) use an implicitly global cookie variable (no var/let/const), meaning the last-processed full cookie object โ including its value, httpOnly flaโฆ | |
| 35 | Credential Theft | low | js/cookie_helpers.js (line 140) | The `cookiesToString` functions serialize full cookie objects โ including name, value, domain, path, secure flag, httpOnly flag, and expiration โ into clipboard-ready strings. The variable `cookie` is assigned withoutโฆ | |
| 36 | Other | low | popup.html (line 271) | The help button in the popup links to an external HTTP (not HTTPS) URL opened from the privileged extension context. Plain HTTP navigations from extensions are susceptible to MITM interception and could be used to serโฆ | |
| 37 | Other | low | options_pages/support.html (line 45) | The support page references getlocalization.com over plain HTTP. This third-party service appears defunct and the domain may have been re-registered by an unknown party. Links opened via chrome.tabs.create to plain HTโฆ | |
| 38 | Phishing | low | js/background.js (line 21) | On install and update, the extension opens external pages over plain HTTP rather than HTTPS. That is not direct malware behavior by itself, but it is a suspicious legacy pattern because the destination content could bโฆ | |
