| 1 | Code Injection | critical | background.js (line 8) | The parseJSON helper falls back to `(Function(str))()` when JSON.parse fails, which is functionally equivalent to eval and will execute any non-JSON string as JavaScript. This function is invoked on values returned fr… | |
| 2 | Remote Code Loading | critical | ct.js (line 3765) | The content script (injected into every page and every frame via <all_urls> + all_frames:true) creates an inline <script> element in the page's DOM that fetches text from the hard-coded remote C2 endpoint https://p.ex… | |
| 3 | Code Injection | high | background.js (line 135) | Message handler exposes unrestricted SET_STORAGE (write any key/value to chrome.storage.local with no validation or key allow-list) and GET_STORAGE which then routes the retrieved value through the unsafe parseJSON ab… | |
| 4 | Data Exfiltration | high | ct.js (line 3779) | Generic network dispatch handler ('gnd') makes jQuery AJAX requests to arbitrary URLs with arbitrary data taken from message parameters. This is injected into every frame of every page via the <all_urls> content scrip… | |
| 5 | Data Exfiltration | high | ct.js (line 3787) | The content script exposes a generic 'gnd' (get-and-deliver) proxy: any component that can sendMessage to this content script may ask it to issue a jQuery AJAX request to an arbitrary URL with arbitrary payload and re… | |
| 6 | Network Interception | high | background.js (line 6356) | The background script exposes a generic 'NET' message command that performs an arbitrary jQuery.ajax() call using attacker-controlled settings (URL, method, headers, body). Any extension page — or any page that can re… | |
| 7 | Network Interception | high | ct.js (line 3779) | The content script (injected on <all_urls>, all_frames) exposes a 'gnd' command that performs a jQuery.ajax request to an arbitrary URL with arbitrary data/dataType passed by whoever sends the runtime message. Because… | |
| 8 | Network Interception | high | ct.js (line 3779) | Generic AJAX proxy: the content script accepts a `gnd` command via chrome.runtime messaging and performs a fully attacker-controlled jQuery.ajax call (url, dataType, and payload are all taken verbatim from the message… | |
| 9 | Network Interception | high | ct.js (line 3779) | The content script (running on <all_urls>, all_frames) accepts a 'gnd' command via chrome.runtime.onMessage and performs arbitrary jQuery.ajax() requests to any URL/data controlled by the sender, returning the respons… | |
| 10 | Network Interception | high | ct.js (line 3787) | The content script exposes a `gnd` command that performs an arbitrary jQuery AJAX request to any URL/dataType/data supplied by the caller and returns the response. Because content scripts run with the host page's orig… | |
| 11 | Privilege Escalation | high | ct.js (line 3765) | The content script listens for window postMessage events on every page and, without any origin/source check, forwards any payload tagged topic=='base_config' into the extension's persistent chrome.storage under key 'b… | |
| 12 | Privilege Escalation | high | ct.js (line 3765) | Content script (injected into every page via `<all_urls>`) registers a `window.postMessage` listener with no origin check and stores any arbitrary payload sent with topic `base_config` into extension storage. Any mali… | |
| 13 | Privilege Escalation | high | ct.js (line 3766) | Content script listens for window.postMessage events from untrusted web pages and writes arbitrary 'base_config' data into chrome.storage without origin validation. Any page the user visits can inject configuration in… | |
| 14 | Privilege Escalation | high | ct.js (line 3765) | Registers a `window.message` listener with no origin or source validation. Any web page can postMessage `{topic: 'base_config', data: ...}` and the content script forwards the arbitrary payload into the extension's pe… | |
| 15 | Remote Code Loading | high | manifest.json (line 23) | The CSP whitelists script execution from 's.union.360.cn' (Qihoo 360's ad/analytics network) and from plain-HTTP 'http://localhost:8080', and enables 'unsafe-eval'. Together this permits loading and eval'ing remote co… | |
| 16 | Remote Code Loading | high | ct.js (line 3779) | The all-frames/all-URLs content script exposes a generic `gnd` runtime-message handler that performs a jQuery AJAX request to any URL with arbitrary data supplied by the sender and returns the response. Any other exte… | |
| 17 | Remote Code Loading | high | ct.js (line 3765) | The content script registers a window 'message' listener (no origin check) that accepts any postMessage with topic 'base_config' and forwards the attacker-controlled payload to the background via SET_STORAGE. Any webp… | |
| 18 | Remote Code Loading | high | ct.js (line 3765) | Content script (matches <all_urls>) injects an inline <script> element into document.body that fetches remote configuration from https://p.extfun.com/sr/base_config and posts the response back via window.postMessage f… | |
| 19 | Remote Code Loading | high | popup.js (line 813) | When a string fails JSON.parse, the code falls back to `Function(t)()`, which compiles and executes the string as JavaScript. This is functionally equivalent to eval() and is exposed as an exported helper (n=E), meani… | |
| 20 | Remote Code Loading | high | ct.js (line 3765) | The content script (which runs on <all_urls>) builds a <script> tag with dynamic `fetch()` code targeting https://p.extfun.com/sr/base_config and injects it into the host page's DOM. The page-context script retrieves … | |
| 21 | Tracking | high | background.js (line 5248) | The full Fingerprint2 browser-fingerprinting library (canvas, WebGL, fonts, plugins, UA, timezone, hardware concurrency, lied-OS/browser heuristics, etc., hashed into an x64hash128 device ID) is bundled into the backg… | |
| 22 | Tracking | high | ct.js (line 3727) | Hard-coded tracking beacons to tj.extfun.com using pixel-style GIF endpoints (11.gif/install, 10.gif/active, 13.gif/config, 14.gif/page) alongside a report endpoint p.extfun.com/sr1. These emit install/active/per-page… | |
| 23 | Code Injection | medium | popup.js (line 813) | Generic value parser that attempts JSON.parse first and, on failure, falls back to executing the input string as JavaScript via the Function constructor. Because the CSP for this extension already whitelists 'unsafe-e… | |
| 24 | Code Injection | medium | popup.js (line 813) | Helper that first tries JSON.parse on a string and, on failure, silently evaluates it as JavaScript via Function(t)(). Feeding this function any non-JSON string (e.g., a value retrieved from remote config or storage) … | |
| 25 | Code Injection | medium | popup.js (line 4882) | Additional dynamic-code-execution sinks via `new Function(...)` and `Function(t)()` exist across popup.js (lines 929, 4882, 4925, 9410). While some are legitimate regenerator/runtime shims, the pattern combined with t… | |
| 26 | Network Interception | medium | ct.js (line 3787) | The content script exposes a generic 'gnd' message handler that will perform a jQuery.ajax request to any URL supplied by the background/popup and return the response body to the caller. This is a universal server-sid… | |
| 27 | Remote Code Loading | medium | manifest.json (line 28) | The extension's CSP whitelists script execution from `http://localhost:8080` (plaintext HTTP) and `https://s.union.360.cn` (Qihoo 360 analytics domain), in addition to enabling `'unsafe-eval'`. The localhost entry is … | |
| 28 | Remote Code Loading | medium | manifest.json (line 28) | CSP allows script loading from http://localhost:8080 (a developer endpoint that should never ship in production) and from s.union.360.cn (Qihoo 360 infrastructure). Combined with 'unsafe-eval', this widens the script … | |
| 29 | Remote Code Loading | medium | manifest.json (line 28) | The CSP permits `'unsafe-eval'` and whitelists script loading from `http://localhost:8080` (plaintext, developer-only endpoint shipped to users) and `s.union.360.cn` (Qihoo 360 tracking host). Combined, these widen th… | |
| 30 | Remote Code Loading | medium | manifest.json (line 28) | The extension's CSP whitelists 'unsafe-eval' plus remote script sources including http://localhost:8080 (a plaintext developer endpoint that should never ship in a production extension with 100k users) and https://s.u… | |
| 31 | Remote Code Loading | medium | manifest.json (line 28) | Extension CSP allow-lists `unsafe-eval`, `http://localhost:8080` (plaintext, developer host left in a shipped build), and `https://s.union.360.cn` (Qihoo 360 — a third-party ad/analytics host unrelated to the extensio… | |
| 32 | Remote Code Loading | medium | manifest.json (line 28) | The extension's CSP whitelists 'unsafe-eval', plain-HTTP http://localhost:8080, and the third-party Chinese ad/statistics host s.union.360.cn as script sources. Permitting an unencrypted localhost origin in a publishe… | |
| 33 | Tracking | medium | background.js (line 1) | Hardcoded Google Analytics 4 Measurement Protocol credentials (measurement_id and api_secret) baked into the service worker, used to ship a randomly-generated persistent client_id plus event/page data to google-analyt… | |
| 34 | Tracking | medium | background.js (line 6332) | Loads Google Analytics (property UA-149768454-1) from the background page and exposes GA_PAGE/GA_EVENT message commands so popup/options pages can emit arbitrary pageview/event beacons. The analytics ping includes GA'… | |
| 35 | Tracking | medium | background.js (line 6385) | On install, for zh-CN locale only, the extension force-opens a tab to https://extensions-manager.com and registers that host's /feedback.html as the uninstall-redirect URL. Branching install/uninstall behavior on a Ch… | |
| 36 | Tracking | medium | ct.js (line 3727) | Defines a telemetry/tracking pixel framework with distinct endpoints for page views (/14.gif), installs (/11.gif), active usage (/10.gif), and config fetches (/13.gif), plus a /sr1 report endpoint, and packages the ex… | |
| 37 | Tracking | medium | ct.js (line 3727) | Hard-coded telemetry scaffolding with endpoints for page views (/14.gif), install (/11.gif), active (/10.gif) and config (/13.gif) tracking pixels, tagged with extension id and version. Although `server`/`tjServer` st… | |
| 38 | Tracking | medium | ct.js (line 3727) | Configuration defines tracking-pixel-style endpoints (/10.gif /11.gif /13.gif /14.gif) for 'page', 'install', 'active', and 'config' events. The classic 1x1 GIF tracking pattern is used to report extension-lifecycle e… | |
| 39 | Tracking | medium | ct.js (line 3727) | Defines tracking-beacon endpoints (`/14.gif`, `/11.gif`, `/10.gif`, `/13.gif`) for page/install/active/config events alongside a reporting path `/sr1`, plus a payload containing the extension id/version. The server ba… | |
| 40 | Tracking | medium | ct.js (line 3727) | Hardcoded telemetry/tracking scaffolding typical of Chinese ad-tracking SDKs: gif-pixel beacons for page/install/active/config events plus a crash-report endpoint ('/sr1'), along with identifiers (extension id, versio… | |
| 41 | Tracking | medium | ct.js (line 3727) | Hard-coded third-party endpoints at p.extfun.com / tj.extfun.com with pixel-style tracking paths (/10.gif, /11.gif, /13.gif, /14.gif) for page/install/active/config beaconing. The content script runs on every page (<a… | |
| 42 | Tracking | medium | ct.js (line 3727) | Hardcoded first-party telemetry endpoints (p.extfun.com, tj.extfun.com) with .gif pixel beacons for page-view, install, active, and config events, plus a report path `/sr1`. Beaconing browsing activity and install sta… | |
| 43 | Unauthorized Data Collection | medium | background.js (line 78) | firePageView/fireEvent transmit user navigation context (page paths and titles passed in via runtime messages) plus a stable per-install client_id to a third-party analytics endpoint. Because the message senders suppl… | |
| 44 | Unauthorized Data Collection | medium | background.js (line 6401) | On startup the extension enumerates every open tab and registers onCreated/onUpdated/onRemoved/onReplaced listeners to continuously track every URL the user visits, caching them in an in-memory map. Although ostensibl… | |
| 45 | Unauthorized Data Collection | medium | ct.js (line 3754) | On every page load the content script pulls the attacker-controllable `base_config` out of extension storage and writes it to a second key (`up`), propagating remotely-injected configuration across extension surfaces.… | |
