| 1 | Code Injection | critical | pages/background.js (line 48474) | The Facebook integration calls eval() on a dashManifest string extracted directly from intercepted Facebook API response bodies. This string is externally sourced from live network traffic, meaning if a response is ta… | |
| 2 | Credential Theft | critical | pages/popup.js (line 37829) | The Redux request middleware reads an 'Authorization' cookie and appends its accessToken to the headers of every single outbound API request, including the fetchAdExtensions call to del.flashvd.com. This means the aut… | |
| 3 | Credential Theft | critical | pages/content.js (line 18511) | The content script reads both the xsrf-token cookie (forwarded as x-xsrf-token header) and the Authorization cookie's accessToken field from pages the user visits, then attaches these to every outgoing API call to api… | |
| 4 | Data Exfiltration | critical | pages/background.js (line 46985) | The full URL of the user's active browser tab is transmitted to the extension developer's server (`api.flashvd.com`) as a query parameter when certain video resolutions are requested. This leaks the user's browsing hi… | |
| 5 | Remote Code Loading | critical | manifest.json (line 42) | The manifest explicitly whitelists 'unsafe-eval' in the CSP, enabling dynamic code execution via eval() and Function() constructor throughout the extension. It also whitelists https://static.trackivation.com — a known… | |
| 6 | Code Injection | high | pages/background.js (line 48474) | An `eval()` call is applied to a `dashManifest` string extracted directly from a network response (Facebook video page content). If the regex guard (`evalRegex`) fails to catch malicious content, an attacker who can i… | |
| 7 | Data Exfiltration | high | pages/background.js (line 41806) | When a video is flagged `internalFetch`, the full video URL (and optional audio URL) is sent to `api.flashvd.com/downloadMP4Video` for server-side processing instead of downloading directly. This routes the user's vid… | |
| 8 | Network Interception | high | pages/background.js (line 48357) | Multiple webRequest.onBeforeRequest listeners intercept and read the full request bodies of VKontakte requests (with the 'blocking' flag, allowing request modification) and Facebook GraphQL and unified video API calls… | |
| 9 | Network Interception | high | pages/background.js (line 41567) | The extension registers a webRequest.onResponseStarted listener on <all_urls> with access to response headers, intercepting every HTTP/HTTPS response across all tabs and sites. Combined with the onTabsUpdated and onTa… | |
| 10 | Network Interception | high | pages/background.js (line 41567) | A `webRequest.onResponseStarted` listener is registered against `<all_urls>` — meaning every HTTP and HTTPS response the browser receives triggers the callback with the response URL and headers. Combined with the `web… | |
| 11 | Privilege Escalation | high | manifest.json (line 40) | Setting web_accessible_resources to ["*"] exposes every extension resource (all JS bundles, HTML pages, and assets) to any web page. Any website can load and inspect extension internals via chrome-extension:// URLs, e… | |
| 12 | Privilege Escalation | high | manifest.json (line 40) | The manifest whitelists `'unsafe-eval'` in script-src (enabling `eval()` and `new Function()` throughout the extension) and explicitly permits `https://static.trackivation.com` as a trusted script origin — meaning any… | |
| 13 | Remote Code Loading | high | pages/background.js (line 41504) | Every 3 hours the extension fetches a URL blacklist from the externally-controlled server api.flashvd.com/blacklist and uses those patterns to determine which network requests are processed by the webRequest listeners… | |
| 14 | Remote Code Loading | high | pages/content.js (line 2356) | The content script implements a SET_AD_EXTENSIONS Redux action that stores remotely-fetched data from del.flashvd.com into application state. This creates a persistent remote configuration channel: the operator server… | |
| 15 | Remote Code Loading | high | pages/popup.js (line 5269) | The Iconfont/create() function dynamically injects a script tag with a caller-controlled URL into the document body. If any component passes a URL sourced from the fetchAdExtensions server response at del.flashvd.com … | |
| 16 | Remote Code Loading | high | pages/background.js (line 2164) | The extension fetches a server-controlled list of "advertised extensions" from `https://del.flashvd.com/a/<extensionId>` and renders them as clickable links inside the popup UI. This is a server-driven ad-injection me… | |
| 17 | Remote Code Loading | high | pages/content.js (line 31575) | The content script dynamically injects a `<script>` tag pointing to `https://www.webrtc-experiment.com/gif-recorder.js` into the host page's DOM. This loads third-party code from an external server at runtime into eve… | |
| 18 | Tracking | high | pages/popup.js (line 14569) | On every popup open, the extension dispatches a FETCH_AD_EXTENSIONS action that beacons to https://del.flashvd.com/a/<EXTENSION_ID>, a hardcoded ad-delivery subdomain. This tracks popup open frequency, enables user en… | |
| 19 | Tracking | high | pages/background.js (line 49260) | The background page dynamically loads two external tracking scripts: Google Analytics (UA-48557534-3) and a tracker from `static.trackivation.com` with a hardcoded API key and the extension's own ID embedded in the UR… | |
| 20 | Network Interception | medium | pages/background.js (line 48795) | A `webRequestBlocking` listener intercepts all POST requests to `vk.com` with access to the raw request body. While the handler appears to only read video metadata, the `blocking` flag means the listener can stall or … | |
| 21 | Other | medium | pages/popup.html (line 1) | The popup HTML is titled 'Template New Tab' rather than anything related to Flash Video Downloader, strongly indicating this UI was grafted onto a pre-existing new-tab hijacking or adware template. New-tab extension t… | |
| 22 | Other | medium | pages/background.js (line 41497) | The condition `details.reason = 'install'` uses assignment (`=`) instead of equality (`===`). The assignment always evaluates to the truthy string `'install'`, so `chrome.tabs.create()` fires on every install, update,… | |
| 23 | Tracking | medium | pages/background.js (line 41261) | The background page dynamically injects the Google Analytics script at runtime and fires a pageview event with the extension version. The displayfeatures plugin enables demographic and interest-based tracking of users… | |
| 24 | Tracking | medium | pages/background.js (line 41497) | The onInstalled handler uses assignment (=) instead of equality comparison (===), making the condition always truthy. This causes a new tab to open to https://www.flashvd.com/welcome on every extension activation (not… | |
