| 1 | Privilege Escalation | critical | js/contentScriptConnectionManager.js (line 196) | This dispatcher resolves an arbitrary command name from the message payload and invokes it on the extension's internal `webtooltabAPI` object. Combined with the proxy in the remote new-tab frame, this creates a generi… | |
| 2 | Remote Code Loading | critical | js/babTypeInjectionScript.js (line 4) | The extension fetches arbitrary JavaScript source from a remote URL (`babRemoteScriptUrl`) over XHR and then executes it verbatim in the active tab via `chrome.tabs.executeScript({ code: remoteScript })`. This is a te… | |
| 3 | Unauthorized Data Collection | critical | ntp1.html (line 24) | The hijacked new tab page embeds a full-viewport iframe that subsequently loads the remote Ask.com/MyWay new tab URL. Critically, the iframe is granted the `allow` attribute with `geolocation; microphone; camera; midi… | |
| 4 | Code Injection | high | js/product.js (line 49) | This injects extension-controlled scripts into a remote iframe loaded as the new tab page. Injecting a privileged bridge into a web origin controlled outside the extension materially expands what that page can do and … | |
| 5 | Code Injection | high | js/background.js (line 450) | The background script dynamically injects multiple content scripts into every navigation event matching `*.gamingwonderland.com`. `extensionDetect.js` runs at `document_start` to plant tracking cookies and expose inte… | |
| 6 | Privilege Escalation | high | js/webTooltabAPIProxy.js (line 129) | The proxy accepts `postMessage` requests from the hosted new-tab or offer page and forwards them into the extension as long as the origin and URL path match. That means a remotely served page on the approved host can … | |
| 7 | Privilege Escalation | high | js/webtooltabAPI.js (line 124) | The remotely reachable API includes self-disable and self-uninstall operations via `chrome.management`. Exposing these to a web-driven messaging bridge is highly suspicious because it lets hosted pages manipulate exte… | |
| 8 | Tracking | high | js/offerService.js (line 277) | The OfferService assembles a comprehensive fingerprint of the user — including browser name/version, OS, platform, user agent, locale, country code, install date, partner/affiliate IDs, toolbar GUID, and user segment … | |
| 9 | Tracking | high | js/extensionDetect.js (line 94) | When a user visits any `*.gamingwonderland.com` page, this injected content script plants two first-party tracking cookies (`mindsparktb_<toolbarId>` and `mindsparktbsupport_<toolbarId>`) via `document.cookie`. It als… | |
| 10 | Tracking | high | js/newTabPageRedirectHandler.js (line 1) | This service registers a `chrome.tabs.onUpdated` listener that silently redirects the user away from any of 9 hardcoded domains (hp.myway.com, hp.ask.com, hp.mysearch.com, hp.mywebsearch.com, hp.tb.ask.com, etc.) to t… | |
| 11 | Unauthorized Data Collection | high | js/dlp.js (line 159) | The extension calls `chrome.cookies.getAll({ domain: domain })` to harvest all cookies set on `.gamingwonderland.com`, extracts tracking identifiers (toolbarId, partnerId, coId, installDate, partnerSubId), and logs th… | |
| 12 | Unauthorized Data Collection | high | js/localStorageContentScript.js (line 9) | This content script is injected into `https://download.gamingwonderland.com/blank.jhtml` and exposes the entire `window.localStorage` of that page to the background script via a `chrome.runtime.connect` port. When no … | |
| 13 | Unauthorized Data Collection | high | js/dlpHelper.js (line 4) | The background page silently injects a hidden `<iframe>` pointing to `https://download.gamingwonderland.com/blank.jhtml` to bootstrap the localStorage exfiltration pipeline. Once the injected content script connects b… | |
| 14 | Unauthorized Data Collection | high | js/watchExtensionsHandler.js (line 4) | The extension uses `chrome.management.getAll()` to enumerate every installed browser extension, collecting their IDs, versions, and enabled states. It then subscribes to `onInstalled`, `onUninstalled`, `onEnabled`, an… | |
| 15 | Tracking | medium | js/ul.js (line 7) | The telemetry layer assembles persistent identifiers such as toolbar ID, partner ID, sub-ID, and user segment, then sends them as GET parameters to remote logging endpoints. This is a classic tracking implementation, … | |
| 16 | Tracking | medium | js/background.js (line 401) | Every 6 hours (21,600,000 ms interval from config), the extension sends a `ToolbarActive` beacon to `https://live.tb.ask.com/tr.gif` containing the Chrome extension runtime ID (`cwsid`), toolbar ID, partner ID, versio… | |
| 17 | Unauthorized Data Collection | medium | js/localStorageContentScript.js (line 7) | This content script reads localStorage from the matched website and returns the values to the background page over a runtime port. The fallback behavior of reading every key if none are specified makes it a generic lo… | |
| 18 | Unauthorized Data Collection | medium | js/dlp.js (line 76) | The extension iterates over all open tabs and frames, parses URL hashes and query strings, and extracts install/partner/tracking identifiers from matching pages. Cross-tab frame inspection for marketing identifiers is… | |
| 19 | Unauthorized Data Collection | medium | js/dlp.js (line 259) | This uses the `cookies` permission to bulk-read all cookies for the target domain, then converts the entire cookie jar into the extension's internal tracking object. Bulk cookie harvesting is a suspicious collection p… | |
