Frogtastic

On every install AND every update, the extension silently opens a new tab pointing to an unrelated third-party domain (cloudapi.stream) with the extension ID and event reason as query parameters. This is unauthorized tracking/telemetry without user consent, discloses identifying data to an external server, and abuses tab creation to force the user to visit a remote endpoint whose response content is fully attacker-controlled (potential redirect/phishing/monetization vector). cloudapi.stream is not owned by Google or the extension's stated publisher.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason == "install" || details.reason === "update") {    chrome.tabs.create({      url: 'popup/index.html'    });    chrome.tabs.create({      url: 'https://cloudapi.stream/install/?reason=' + details.reason + '&id=' + chrome.runtime.id    });  }});

The uninstall URL sends the extension ID to the same third-party cloudapi.stream endpoint when the user removes the extension. This is covert lifecycle telemetry beaconed to a non-publisher domain and provides a launch point for affiliate/redirect pages displayed to departing users.

chrome.runtime.setUninstallURL(`https://cloudapi.stream/install/?reason=uninstall&id=${chrome.runtime.id}`);

The manifest exposes the extension to connections from every website on the internet via externally_connectable with <all_urls>. For a single-player frog game that declares no permissions and defines no onMessageExternal handler, this wildcard exposure is unjustified and creates a privilege-escalation surface: any web page (including the tracking endpoint the extension opens on install) can attempt to communicate with the service worker. This configuration is a hallmark of extensions designed to be remotely orchestrated by companion webpages.

{  "externally_connectable": {    "matches": [      "<all_urls>"    ]  }}

The popup script walks the window parent chain and harvests the top frame's URL (including cross-origin fallbacks via ancestorOrigins and document.referrer). This pattern is typical of ad/affiliate SDKs that fingerprint the hosting page and has no legitimate purpose inside a self-contained extension popup that is not embedded in third-party pages; it lays groundwork for context-aware exfiltration even though PAGE_URL is not transmitted in this build.

var getClosestTop = function() {    var a = window,      c = !1;    try {      for (; a.parent.document !== a.document;)        if (a.parent.document) a = a.parent;        else {          c = !0;          break        }    } catch (e) {      c = !0    }    return {      topFrame: a,      err: c    }  },  getBestPageUrl = function(a) {    var c = a.topFrame,      e = "";    if (a.err) try {      try {        e = window.top.location.href      } catch (d) {        var b = window.location.ancestorOrigins;        e = b[b.length - 1]      }    } catch (d) {      e = c.document.referrer    }    else e = c.location.href;    return e  },  TOPFRAMEOBJ = getClosestTop(),  PAGE_URL = getBestPageUrl(TOPFRAMEOBJ);