Flash Player for Web

The `index.js` outer frame listens for `message` events without validating the sender's origin (`e.origin` is never checked), then issues a `fetch()` to any `href` included in the message and forwards the response body back to the iframe via `postMessage` with a wildcard `"*"` origin. This is an open SSRF-like proxy: any page that can send a `postMessage` to this extension window can cause it to fetch arbitrary URLs using the extension's network context and receive the response. Combined with the broad `activeTab` and `*://*/*` permissions, this could be used to make the extension act as a same-origin proxy to bypass CORS restrictions on behalf of an attacker.

window.addEventListener("message", (e => {  const t = e.data;  "fetch" === t.method && fetch(t.href).then((async e => {    const t = await e.arrayBuffer();    iframe.contentWindow.postMessage({      content: t,      type: e.headers.get("Content-Type")    }, "*")  })).catch((e => iframe.contentWindow.postMessage({    error: e.message  }, "*")))}));

This content script runs at `document_start` on every page across all URLs and injects a dynamically-created script element into `document.documentElement` to globally override `navigator.plugins['Shockwave Flash']` and the `swfobject` global on every page the user visits. Spoofing browser plugin detection this universally can deceive sites into revealing Flash-specific code paths or content, and the DOM-based script injection pattern (create → append → remove) is a classic technique used to execute code before CSP policies fully apply. The misspelling in the filename (`'Flsh Player.plgin'`) suggests hastily-written deceptive code rather than a polished compatibility shim.

const script = document.createElement("script");script.textContent = "\n  navigator.plugins['Shockwave Flash'] = {\n    name: 'Shockwave Flash',\n    description: 'Shockwave Flash 23.0 r0',\n    filename: 'Flsh Player.plgin'\n  };\n  swfobject = {\n    embedSWF(href, id) {\n      const embed = document.createElement('embed');\n      embed.src = href;\n      embed.width = width;\n      embed.height = height;\n      const e = document.getElementById(id);\n      if (e) {\n        e.appendChild(embed);\n      }\n    },\n    hasFlashPlayerVersion() {\n      return true;\n    },\n    ua: {\n      pv: [100, 0, 0]\n    }\n  }\n", document.documentElement.appendChild(script), script.remove()

The background worker injects dynamically-constructed JavaScript code strings directly into active tabs using `chrome.tabs.executeScript` with an inline `code` property built via `String.raw` and `JSON.stringify`. This pattern creates a code-injection vector: if any SWF URL collected from the page contains adversarial content that survives `JSON.stringify`, it could escape the string context and execute arbitrary JS in the tab. Legitimate Flash-finder extensions should pass detected URLs through a fixed UI popup, not by injecting runtime-constructed `prompt()` calls into arbitrary pages.

chrome.tabs.executeScript({  code: String.raw`{        const links = ${JSON.stringify(s)};        prompt('Select a Flash link to start emulation:\n\n' + links.map((s, i) => (i + 1) + ' ' + s).join('\n'), 1);      }`}, ([t]) => {  t && !1 === isNaN(t = Number(t)) && open(n[s[t - 1] || s[0]], e)})

The context-menu handler for 'inject-ruffle' uses `chrome.tabs.executeScript` with an inline code string to create a `<script>` tag and append it to the current page's `document.body`, loading the extension's `ruffle.js` emulator into any arbitrary tab on demand. This effectively gives the extension the ability to load and execute its bundled JavaScript into any page the user is browsing at any time via context menu, which is a privileged script injection capability that significantly expands the extension's attack surface if the emulator itself is compromised or replaced.

"inject-ruffle" === e.menuItemId && chrome.tabs.executeScript(t.id, {  code: `{        const s = document.createElement('script');        s.src = '${chrome.runtime.getURL("/emulator/ruffle.js")}';        document.body.appendChild(s);      }`,  runAt: "document_start"})

The `web_accessible_resources` entry `"/*"` exposes every file in the extension package to any web page — not just the emulator assets. This wildcard means any external website can fetch, load, or reference any extension resource (including JS files, the WASM binary, and HTML pages) via `chrome-extension://` URLs, enabling adversarial pages to probe the extension's internal structure, fingerprint users by extension ID, or attempt to exploit the extension's sandboxed pages. Only the specific emulator resources needed for embedding should be listed here.

{  "web_accessible_resources": [    "icons/*",    "/*",    "/emulator/ruffle.js",    "/emulator/*.wasm"  ]}

The sandboxed `player.html` page completely replaces both `window.fetch` and `window.XMLHttpRequest` with custom implementations that forward all network requests to the parent frame via `top.postMessage({method:'fetch', href:t}, "*")`. Using `"*"` as the target origin means this message is not restricted to the extension's own origin — any page that embeds this player in an iframe can intercept these proxied fetch requests. This proxy architecture means all network requests made by the Flash emulator (potentially including requests to user-visited SWF content and its dependencies) are routed through the extension's parent frame rather than issued directly, creating an interception point for all emulated content's network traffic.

const f = window.fetch;window.fetch = function(...e) {  let t = e[0].url || e[0];  if (t.startsWith("js:") || t.startsWith("chrome-extension")) return f.apply(this, e);  if (!1 === t.startsWith("http")) {    const e = document.createElement("a");    e.setAttribute("href", t), t = e.href  }  return new Promise(((e, s) => {    window.onmessage = t => {      const {        content: r,        type: a,        error: n      } = t.data;      if (n) s(new Error(n));      else {        const t = new Response(r, {          status: 200,          headers: {            "Content-Type": a,            referer: base.href          }        });        e(t)      }    }, top.postMessage({      method: "fetch",      href: t    }, "*")  }))}, window.XMLHttpRequest = class {  ...}

When no SWF embeds are found via DOM element selectors, `find.js` falls back to scanning the entire `document.documentElement.innerHTML` as a raw string using a regex. This reads the complete rendered HTML of every page the user is on, including any sensitive data present in hidden form fields, inline scripts, data attributes, or page content. While ostensibly searching for `.swf` URLs, the full-page HTML read in a content script context is unnecessarily invasive and could be used to harvest page content.

0 === e.length && [...document.documentElement.innerHTML.matchAll(/https?:\/\/.*\.swf/g)].map((t => {  e.push({    href: t  })}))