| 1 | Network Interception | critical | popup.js (line 1564) | The proxy server list (host, port, scheme, username, password) is fetched at runtime from hdbest.fun and may be base64-encoded to evade casual static review. Because all user traffic is then forced through whichever e… | |
| 2 | Network Interception | critical | popup.js (line 255) | The full list of SOCKS5/HTTP proxies the user can route 100% of their browser traffic through is fetched at runtime from a third-party domain (hdbest.fun) with no signature verification or pinning. Whoever controls hd… | |
| 3 | Data Exfiltration | high | background.js (line 174) | Exfiltrates the user's public IP, extension ID, version, timestamp, UI language, country selection, and behaviour events (install, popup_open, proxy_on/off, country_change, etc.) to an attacker-controlled domain hdbes… | |
| 4 | Data Exfiltration | high | background.js (line 82) | Fetches the user's real public IP from a third-party IP-lookup service. The IP is then exfiltrated by sendAnalytics() to hdbest.fun, defeating the privacy promise of a VPN tool by exposing the user's true IP to the op… | |
| 5 | Data Exfiltration | high | background.js (line 169) | The extension exfiltrates the user's public IP, extension ID, version, timestamp, selected country, and event type to an undisclosed third-party domain hdbest.fun (note the misspelled path 'open_app_extesion'). Events… | |
| 6 | Network Interception | high | background.js (line 398) | The proxy bypassList explicitly excludes the operator's own domain hdbest.fun, ensuring telemetry and proxy-list polling reach the operator directly even while the user's other traffic is being routed (and observable)… | |
| 7 | Network Interception | high | background.js (line 281) | Registers an asyncBlocking onAuthRequired listener over <all_urls> that auto-supplies credentials from a remotely-supplied proxy list. Combined with the dynamically fetched HTTP/HTTPS proxy hosts, this lets the operat… | |
| 8 | Network Interception | high | popup.js (line 645) | The list of proxy servers used to tunnel ALL user traffic (the extension declares <all_urls> host_permissions and the 'proxy' permission) is fetched at runtime from hdbest.fun. The operator of that domain can therefor… | |
| 9 | Network Interception | high | background.js (line 263) | Applies attacker-controlled proxy host/port (sourced from hdbest.fun/proxy.json) to chrome.proxy.settings with scope 'regular', routing the user's entire browsing session through third-party SOCKS5/HTTP servers whose … | |
| 10 | Network Interception | high | background.js (line 263) | All browser traffic is routed through a singleProxy whose host/port came from a list dynamically fetched from hdbest.fun (popup.js fetchProxies). Because the proxy can be 'http' (cleartext) and the bypass list is only… | |
| 11 | Network Interception | high | popup.js (line 233) | The proxy server list (host/port pairs) is fetched at runtime from an attacker-controlled domain (hdbest.fun) and used to configure chrome.proxy with mode 'fixed_servers'. Because the extension holds <all_urls> host p… | |
| 12 | Tracking | high | background.js (line 82) | Retrieves the user's real public IP via api.ipify.org and pairs it with extension events that are POSTed to hdbest.fun. Combining a unique extension-install identifier with the user's real IP address (even when the VP… | |
| 13 | Unauthorized Data Collection | high | background.js (line 82) | The extension explicitly fetches the user's real public IP via api.ipify.org and forwards it to the operator's analytics endpoint (see sendAnalytics). For a VPN product, deliberately deanonymising the user by capturin… | |
| 14 | Unauthorized Data Collection | high | background.js (line 169) | The extension exfiltrates the user's public IP address, extension ID, version and timestamp to a third-party server (hdbest.fun) on install and on every popup open. The endpoint is not the developer's verified Chrome … | |
| 15 | Unauthorized Data Collection | high | background.js (line 169) | The extension fetches the user's public IP via ipify.org and POSTs it together with extension ID, version, and timestamp to a non-Google/non-vendor endpoint at hdbest.fun (note the typo 'extesion'). This silently dean… | |
| 16 | Data Exfiltration | medium | background.js (line 231) | Generic analytics relay accepts arbitrary event names and 'extra' payload from the popup and forwards them — together with the user's public IP — to hdbest.fun. The open-ended schema means future popup versions can ex… | |
| 17 | Network Interception | medium | background.js (line 281) | Registers an asyncBlocking onAuthRequired listener over <all_urls> that auto-injects credentials whenever any proxy challenge appears. Combined with chrome.proxy.settings.set({mode:'fixed_servers'}) routing all traffi… | |
| 18 | Network Interception | medium | popup.js (line 789) | Hard-coded fallback proxy IPs are embedded in the client. These are arbitrary residential/VPS endpoints with no provenance disclosed; the user's traffic will be tunnelled through them whenever the dynamic list fetch f… | |
| 19 | Remote Code Loading | medium | popup.js (line 13) | Proxy host/port/scheme and the credentials (username/password) used for proxy auth are pulled at runtime from https://hdbest.fun/api/servers keyed by a device_id (or the subscriber's email). This is server-controlled … | |
| 20 | Tracking | medium | background.js (line 218) | Hard-codes a GA4 Measurement Protocol API secret and ships it in the client-side extension bundle, then mirrors every analytics event (install, popup open, language/country change, proxy on/off, ratings, etc.) along w… | |
| 21 | Tracking | medium | background.js (line 218) | Persists a stable per-install UUID (ga_cid) and ships behavioural events to GA4 via the Measurement Protocol with a hard-coded api_secret embedded in client code. This is silent third-party tracking with no user conse… | |
| 22 | Tracking | medium | background.js (line 196) | Hooks the onInstalled lifecycle to immediately ping the third-party server with the user's IP. This silent install-time beacon is hidden from the user and serves no functional purpose for a VPN. | |
| 23 | Tracking | medium | popup.js (line 727) | Every popup open is reported to the remote server along with the user-selected country and (via background) the user's public IP. The Russian-language comment explicitly states the background script will attach the IP… | |
| 24 | Tracking | medium | background.js (line 195) | Beacons every fresh install to the operator's server (hdbest.fun) along with the user's public IP. Combined with the popup_open analytics event sent from popup.js, this creates a per-user telemetry channel to an undis… | |
| 25 | Tracking | medium | popup.js (line 338) | Every popup open is reported to hdbest.fun via the background analytics channel, including the selected country. Together with the install event and IP exfiltration, this builds a behavioral profile of the user on the… | |
| 26 | Tracking | medium | popup.js (line 315) | Each time the user opens the popup, the extension instructs the background script to send a tracking beacon (popup_open) tagged with the chosen country and the user's public IP to hdbest.fun. This builds a behavioral … | |
| 27 | Unauthorized Data Collection | medium | background.js (line 174) | Resolves the user's public IP via api.ipify.org and POSTs it together with extension ID, version, timestamp, country, ui_lang and arbitrary event metadata to a third-party endpoint at hdbest.fun (a non-corporate domai… | |
| 28 | Unauthorized Data Collection | medium | popup.js (line 1046) | User email addresses entered into the subscription check are sent in clear-text query strings to hdbest.fun (SUBSCRIPTION_API = https://hdbest.fun/api/subscription_status?device_id=). The same domain receives the IP-b… | |
| 29 | Unauthorized Data Collection | medium | background.js (line 82) | The extension fetches the user's public IP from a third-party service (ipify.org). The IP is then bundled with extension identifiers and POSTed to an attacker-controlled endpoint (see sendAnalytics). This is unauthori… | |
| 30 | Tracking | low | popup.js (line 777) | Generates and persists a stable per-install identifier and uses the user's subscription email (when known) as the device_id transmitted on every /api/servers and /api/subscription_status request, allowing the operator… | |
| 31 | Unauthorized Data Collection | low | background.js (line 83) | Resolves the user's real public IP address via a third-party service before every analytics dispatch. While the lookup itself is benign, the resulting IP is then forwarded to hdbest.fun (see sendAnalytics) — i.e. the … | |
