| 1 | Code Injection | critical | js/content.js (line 1) | The content script listens for an 'injectScripts' message from the background page and dynamically creates and injects `<script>` elements into the active page DOM with arbitrary JavaScript content supplied by the extโฆ | |
| 2 | Phishing | critical | js/background.js (line 1) | A base64-encoded string is decoded via `window.atob`, stripped of 16-byte header/footer padding, and then used to forcibly redirect the page via `window.location.href` after suppressing `beforeunload` and stopping pagโฆ | |
| 3 | Remote Code Loading | critical | js/background.js (line 1) | The extension fetches a remote whitelist filter list over plain HTTP (not HTTPS) from an attacker-controlled S3 bucket at `base-filter.s3-website.us-east-2.amazonaws.com`, using the extension's unique `chrome.runtime.โฆ | |
| 4 | Tracking | critical | js/background.js (line 1) | The background script generates a persistent UUID v4 client ID (stored in chrome.storage.local under the key 'cid') and silently sends Google Analytics pageview hits to https://www.google-analytics.com/collect with trโฆ | |
| 5 | Code Injection | high | js/background.js (line 1) | This function replaces `window.eval` and `window.Function` with custom wrappers that intercept all dynamic code execution in injected page contexts. The wrapper calls an external callback `eN` with the full eval/Functโฆ | |
| 6 | Code Injection | high | js/background.js (line 1) | A scriptlet overrides both window.eval and the Function constructor in injected page contexts, logging all arguments before delegating to the originals. This allows the extension to intercept and observe every instancโฆ | |
| 7 | Credential Theft | high | js/background.js (line 1) | The code systematically deletes cookies across multiple path and domain scope combinations (root path, subdomain-prefixed domain) by setting expiry dates in the past, then enumerates all remaining cookies via `documenโฆ | |
| 8 | Credential Theft | high | js/content.js (line 1) | The content script reads all cookies on the current page via `document.cookie`, iterates through them with `CookieController`, and for each matched cookie sends the full `cookieName` and `cookieValue` to the backgrounโฆ | |
| 9 | Credential Theft | high | js/content.js (line 1) | The CookieController reads document.cookie in full on a 1-second polling interval and on every beforeunload event, tracking all cookie additions, deletions, and changes. The change callback receives both the old and nโฆ | |
| 10 | Credential Theft | high | js/content.js (line 1) | When a cookie rule matches, onRuleAppliedCallback is invoked with a payload containing the raw cookieName, cookieValue, cookieDomain, and rule metadata. This fires for every matched cookie on every visited page, passiโฆ | |
| 11 | Network Interception | high | js/background.js (line 1) | The extension registers blocking listeners on webRequest.onBeforeRequest, onBeforeSendHeaders (with requestHeaders+blocking and extraHeaders), and onHeadersReceived (with responseHeaders+blocking) for all URLs. The blโฆ | |
| 12 | Network Interception | high | js/background.js (line 1) | A scriptlet injected into page contexts replaces the global fetch function with a Proxy that intercepts every fetch call, logging the full arguments (URL, headers, body) before deciding whether to block or pass the reโฆ | |
| 13 | Obfuscation | high | js/popup.js (line 1) | The entire popup.js file uses pervasive obfuscation with all 40+ variable and function names replaced with meaningless 2-character identifiers (Pr, af, BI, Sb, sQ, Hw, Ro, bB, RY, xG, Wp, cE, Fi, etc.). This level of โฆ | |
| 14 | Privilege Escalation | high | js/content.js (line 1) | The code intercepts access to `contentWindow` and `contentDocument` on all frame/iframe/object elements by redefining their property getters. Whenever the page accesses a frame's contentWindow, the `ZD` function evaluโฆ | |
| 15 | Privilege Escalation | high | js/content.js (line 1) | On every HTTP/HTTPS page load, the extension serializes the `injectPageScriptAPI` function to a string using `.toString()` and injects it as a new `<script>` element into the page's main world, bypassing the isolated โฆ | |
| 16 | Privilege Escalation | high | js/background.js (line 1) | On installation, the extension immediately queries ALL currently open browser tabs and programmatically injects content.js into every one of them using executeScript with allFrames:true. This bypasses the normal conteโฆ | |
| 17 | Privilege Escalation | high | js/background.js (line 4) | On installation, the background script immediately queries all currently open browser tabs and programmatically injects the content script into every tab and all frames via tabs.executeScript. This is an aggressive prโฆ | |
| 18 | Tracking | high | js/background.js (line 1) | The background page generates and persists a UUID-based client ID (`cid`) in `chrome.storage.local` and then sends a Google Analytics pageview hit that includes the tracking ID, the persistent `cid`, and the full `chrโฆ | |
| 19 | Tracking | high | js/background.js (line 4) | The extension generates a persistent UUID stored in chrome.storage.local under the key 'cid' and silently sends a Google Analytics pageview hit (with the UUID and chrome.runtime.id) to https://www.google-analytics.comโฆ | |
| 20 | Unauthorized Data Collection | high | js/content.js (line 1) | The `CookieController.listenCookieChange` method establishes a polling interval (every 1 second by default) that continuously monitors `document.cookie` for any changes on every visited page. Every time cookies changeโฆ | |
| 21 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension POSTs filter rule hit statistics to https://chrome.adtidy.org/rulestats.html, including the stats payload, extension version, browser type, and the IDs and versions of every active filter. While AdGuard'โฆ | |
| 22 | Data Exfiltration | medium | js/content.js (line 1) | The page script messaging bridge uses `postMessage` with a wildcard target origin (`"*"`) when sending messages from within page-injected scripts back to the content script bridge. Using `"*"` as the target origin meaโฆ | |
| 23 | Data Exfiltration | medium | js/background.js (line 1) | The extension can POST full URLs the user is visiting to https://chrome.adtidy.org/url-report.html along with a message type and optional comment. Although designed for user-submitted URL reports, this function is calโฆ | |
| 24 | Data Exfiltration | medium | js/content.js (line 1) | The content script uses window.postMessage with a wildcard targetOrigin ('*') to broadcast messages containing the element URL, full document URL, and request type. Using '*' means any frame on the page โ including maโฆ | |
| 25 | Obfuscation | medium | js/content.js (line 1) | The entire content script is a single-line minified bundle (~92KB) using a Browserify-style module loader with systematically renamed single and two-character variable names throughout (e.g., `ay`, `eN`, `Wy`, `wY`, `โฆ | |
| 26 | Obfuscation | medium | js/popup.js (line 1) | The entire popup.js is a single minified, bundled file using a browserify-style module loader with single-character obfuscated variable names throughout. The aggressive single-character variable renaming across all moโฆ | |
| 27 | Obfuscation | medium | js/background.js (line 1) | A scriptlet traps the 'ysmm' property on the window object. When set, it decodes the value through a multi-step obfuscation: interleaved character splitting, XOR operations on digit pairs, base64 decode via atob(), thโฆ | |
| 28 | Other | medium | js/background.js (line 1) | The extension hardcodes AdGuard's private API key (4DDBE80A3DA94D819A00523252FB6380) and communicates directly with AdGuard's proprietary backend infrastructure (chrome.adtidy.org, sb.adtidy.org, filters.adtidy.org) wโฆ | |
| 29 | Other | medium | js/background.js (line 1) | A hardcoded API key ('4DDBE80A3DA94D819A00523252FB6380') for the chrome.adtidy.org backend is embedded in plaintext in the extension bundle, exposing it to any user who inspects the source. This credential could be usโฆ | |
| 30 | Tracking | medium | js/background.js (line 1) | The `getExtensionParams()` function assembles a fingerprinting payload containing a persistent client ID (`cid`), the user's browser locale (`lang`), the extension version (`v`), and the extension ID (`id`). This paraโฆ | |
| 31 | Tracking | medium | js/popup.js (line 1) | On every tick of a 1-second setInterval, the popup extracts the active tab's full URL hostname and numeric tab ID and relays both to the background script via runtime.sendMessage. While the returned statistics are useโฆ | |
| 32 | Unauthorized Data Collection | medium | js/background.js (line 1) | The `sendHitStats` function POSTs detailed filter rule hit statistics โ including the browser type, extension version, and per-filter IDs and versions โ to a remote `ruleStatsUrl` backend. Combined with the persistentโฆ | |
| 33 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension sends hashed URL prefixes of pages the user visits to https://sb.adtidy.org/safebrowsing-lookup-short-hash.html for safe browsing checks. While safe-browsing lookups are common in security tools, this seโฆ | |
| 34 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension transmits filter rule hit statistics, the extension version, browser type, and filter IDs/versions to https://chrome.adtidy.org/rulestats.html via XHR POST without user knowledge or disclosure. Filter ruโฆ | |
| 35 | Unauthorized Data Collection | low | js/popup.js (line 1) | The popup queries the active tab's URL and extracts the hostname, then sends this along with the tab ID to the background script via runtime.sendMessage on every popup open. While the stated purpose is to retrieve ad-โฆ | |
