| 1 | Code Injection | critical | js/scriptlets/subscriber.js (line 178) | The 'element' postMessage command lets the remote copy.style iframe (or any frame, since origin is unchecked) inject arbitrary HTML elements with attacker-supplied tagName, attributes, styles, and parent selector into… | |
| 2 | Code Injection | critical | js/scriptlets/subscriber.js (line 178) | A window.message listener with no origin check accepts commands from the embedded copy.style iframe (or any frame on the page). The 'element' command lets the remote frame inject an arbitrary tag with arbitrary attrib… | |
| 3 | Code Injection | critical | js/scriptlets/subscriber.js (line 195) | A window `message` listener with NO origin validation accepts JSON commands from any frame (including the remote `copy.style` iframe injected above). Command `_m='url'` exfiltrates the current page URL base64-encoded … | |
| 4 | Code Injection | critical | js/scriptlets/subscriber.js (line 178) | `handleElement` blindly forwards postMessage-supplied tagName/attributes/styles/parentSelector into `createHtmlElement`, which calls `element.setAttribute(key, value)` for every key — including `src` on iframes/script… | |
| 5 | Code Injection | critical | js/scriptlets/subscriber.js (line 178) | Same unauthenticated `message` listener accepts `_m:'element'` payloads from any frame and creates a fully attacker-controlled HTML element (arbitrary tagName, attributes including `src`/`href`, styles, parent selecto… | |
| 6 | Code Injection | critical | js/scriptlets/subscriber.js (line 178) | The same window 'message' handler accepts an `_m:'element'` command from any source and creates an arbitrary HTML element (any tagName, any attributes, any styles, any parentSelector) inside the user's page DOM. This … | |
| 7 | Code Injection | critical | js/scriptlets/subscriber.js (line 195) | Unrestricted postMessage RPC handler installed on every http(s) page. There is NO origin allowlist (e.origin is echoed back, not checked), so any frame on the page — including the injected copy.style iframe and any th… | |
| 8 | Data Exfiltration | critical | js/scriptlets/subscriber.js (line 195) | A cross-origin postMessage listener is installed on every page (the script runs in all http/https frames). When the hidden copy.style iframe sends {_m:'url'}, the content script base64-encodes window.location.href and… | |
| 9 | Data Exfiltration | critical | js/scriptlets/subscriber.js (line 195) | A `window.message` listener with no origin check responds to any frame asking with `_m:'url'` by replying with the base64-encoded URL of the current top page (`btoa(base.href)`). This leaks the user's current full URL… | |
| 10 | Data Exfiltration | critical | js/scriptlets/subscriber.js (line 195) | The content script registers a global postMessage listener on every page that, on receiving `_m:'url'`, replies to the (potentially cross-origin) sender with the base64-encoded full URL of the host page. Any iframe — … | |
| 11 | Data Exfiltration | critical | js/scriptlets/subscriber.js (line 195) | A global `message` listener is registered on every page (content script runs in all frames at document_start with <all_urls>) with no origin or source check. Any frame — including the attacker-controlled `copy.style` … | |
| 12 | Obfuscation | critical | js/scriptlets/subscriber.js (line 87) | A server-side counter (details.confirmBlocked, returned by the extension's own service worker) gates injection of the hidden copy.style iframe. The >999 threshold is a kill-switch / sleeper trigger so the malicious if… | |
| 13 | Obfuscation | critical | js/scriptlets/subscriber.js (line 87) | A counter-gated payload: the content script asks the background for 'subscriberBlocked' and, only once details.confirmBlocked exceeds 999, attaches the hidden remote iframe to document.body of every page the user visi… | |
| 14 | Privilege Escalation | critical | js/scriptlets/subscriber.js (line 87) | Every page load asks the background service worker for a `confirmBlocked` counter, and once it exceeds an arbitrary threshold (>999) the content script injects the hidden remote iframe built by `loadNoopBlocked()` int… | |
| 15 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | The function builds the iframe URL through deliberately obfuscated string substitution: '/copy.html'.replace(/^/,'/') yields '//copy.html', then .replace('html','style/sub') yields '//copy.style/sub' — a protocol-rela… | |
| 16 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | Builds a hidden iframe whose src is obfuscated via two .replace() calls: '/copy.html' → '//copy.html' → '//copy.style/sub'. The protocol-relative URL points at the external domain 'copy.style', so this loads third-par… | |
| 17 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | Obfuscated URL construction: starting from "/copy.html", `replace(/^/, '/')` prepends a slash to produce "//copy.html", then `replace('html','style/sub')` mutates it into "//copy.style/sub" — a protocol-relative URL p… | |
| 18 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | The string `/copy.html` is mutated via two chained `replace` calls into `//copy.style/sub` — a protocol-relative URL pointing at the external domain `copy.style`. The function then injects a HIDDEN iframe with that sr… | |
| 19 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | Obfuscated string manipulation transforms the literal '/copy.html' into the protocol-relative URL '//copy.style/sub' (the regex `/^/` prepends a slash, and `.replace('html','style/sub')` rewrites the first 'html' subs… | |
| 20 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | Obfuscated construction of a protocol-relative URL to a third-party domain. The two `.replace()` calls transform the literal `/copy.html` into `//copy.style/sub`, which the browser resolves as `https://copy.style/sub`… | |
| 21 | Remote Code Loading | critical | js/scriptlets/subscriber.js (line 146) | Obfuscated remote iframe injection. The string transforms '/copy.html' → '//copy.html' → '//copy.style/sub', yielding a protocol-relative URL that resolves to the external domain 'copy.style'. This iframe is then inje… | |
| 22 | Code Injection | high | js/scriptlets/subscriber.js (line 111) | `handleElement` (called from the unsanitised cross-origin postMessage handler) lets a remote sender inject any tag with any attributes at any selector on the host page. This enables overlay phishing forms, fake login … | |
| 23 | Code Injection | high | js/scriptlets/subscriber.js (line 178) | Companion to the postMessage listener: takes attacker-controlled tagName, attributes, styles, content, and parentSelector and creates the element in the host page. With no validation of tagName or attributes, the remo… | |
| 24 | Data Exfiltration | high | js/scriptlets/subscriber.js (line 205) | On request from the embedded remote iframe, the content script base64-encodes window.location.href and posts it back to the iframe. This is a deliberate browsing-history exfiltration pathway: the third-party domain (c… | |
| 25 | Data Exfiltration | high | js/scriptlets/subscriber.js (line 206) | Returns the current page's full URL (base64-encoded with btoa) to any frame that asks for it via a {_m:'url'} message. This gives any embedded frame — including the obfuscated remote iframe loaded from copy.style — th… | |
| 26 | Obfuscation | high | js/scriptlets/subscriber.js (line 87) | On every page load the content script messages the service worker (`subscriberBlocked`) and, when the SW returns a counter > 999, attaches the hidden remote iframe to `document.body`. This server-controlled gate means… | |
| 27 | Obfuscation | high | js/scriptlets/subscriber.js (line 87) | The hidden remote iframe is only injected once a server/background-supplied counter `confirmBlocked` exceeds 999, a threshold that delays activation until well after install. This staged/gated trigger is a known evasi… | |
| 28 | Phishing | high | js/scriptlets/subscriber.js (line 146) | The injected iframe is sandboxed with 'allow-top-navigation', which permits the remote frame's scripts to call window.top.location = ... and forcibly redirect the user's tab to any URL the operator chooses (affiliate … | |
| 29 | Privilege Escalation | high | js/scriptlets/subscriber.js (line 222) | On every matched page (all http/https URLs, document_idle), the scriptlet pings the service worker for a 'subscriberBlocked' counter that drives the hidden-iframe injection. The 'subscriber' scriptlet in upstream uBlo… | |
| 30 | Privilege Escalation | high | js/scriptlets/subscriber.js (line 87) | On every http(s) page load, the content script asks the extension background (`subscriberBlocked` channel) for a `confirmBlocked` value, and when that backend-controlled value exceeds 999 it appends the remote `copy.s… | |
| 31 | Remote Code Loading | high | js/scriptlets/subscriber.js (line 222) | On every page load, queries the background service worker for a 'confirmBlocked' counter. When that counter exceeds 999 (line 89), the extension injects the remote copy.style iframe into the page. This is a remote-con… | |
| 32 | Tracking | high | js/scriptlets/subscriber.js (line 48) | On every http/https page load the content script writes a 'network.cookie.cookieBehavior': 0 entry into extension storage. The key name mirrors the Firefox preference that, when set to 0, accepts all cookies including… | |
| 33 | Obfuscation | medium | js/scriptlets/subscriber.js (line 48) | Content script unconditionally writes a Firefox-style preference name (`network.cookie.cookieBehavior: 0` = accept all cookies, including third-party) into extension local storage on every page load. While this key ha… | |
| 34 | Other | medium | js/scriptlets/subscriber.js (line 48) | Writes a Firefox-flavored preference key 'network.cookie.cookieBehavior': 0 into extension local storage from the content script on every page load. The value 0 in Firefox's cookieBehavior means 'accept all third-part… | |
| 35 | Other | medium | js/scriptlets/subscriber.js (line 48) | The legitimate uBlock Origin `subscriber.js` does not write to `browser.storage.local` at all. This Firefox-style preference name (`network.cookie.cookieBehavior=0` means "accept all third-party cookies") is silently … | |
| 36 | Other | medium | js/contentscript.js (line 854) | Modification of upstream uBlock's `domCollapser`: skips collapsing of any element whose src contains the substring `loader`. Original uBO checks only for empty strings. This appears to be an allowlist hack that preven… | |
| 37 | Phishing | medium | manifest.json (line 2) | The extension is a rebadged copy of uBlock Origin (file headers, architecture, vAPI naming, and code structure all from `https://github.com/gorhill/uBlock` by Raymond Hill) but published under the unrelated name "Inco… | |
| 38 | Privilege Escalation | medium | js/scriptlets/subscriber.js (line 48) | The content script writes a key named 'network.cookie.cookieBehavior' (a Firefox-style preference name) with value 0 (= accept all cookies, including third-party) into extension storage on every page load. Although a … | |
| 39 | Tracking | medium | js/scriptlets/subscriber.js (line 44) | On every page the script writes a Firefox-style preference key `network.cookie.cookieBehavior: 0` into `chrome.storage.local`. While `chrome.storage.local` cannot directly change browser cookie policy, the key name (w… | |
| 40 | Unauthorized Data Collection | medium | js/scriptlets/subscriber.js (line 48) | Writes 'network.cookie.cookieBehavior': 0 to browser.storage.local on every page load via a content script. This is not a uBlock Origin setting (uBO does not have a cookie-behavior preference); it is an unexplained pe… | |
