| 1 | Code Injection | critical | js/babAPI.js (line 69) | The BabAPI exposes an 'inject-script' feature that accepts an arbitrary JavaScript code string (babMessage.args.code) and executes it in the active tab using chrome.tabs.executeScript. The target frame is selected by … | |
| 2 | Data Exfiltration | critical | js/dlpHelper.js (line 4) | A hidden iframe is covertly injected into the background page pointing to https://download.internetspeedutility.net/blank.jhtml. A content script (localStorageContentScript.js) injected into that page then reads the p… | |
| 3 | Remote Code Loading | critical | js/babTypeInjectionScript.js (line 4) | The BabTypeInjectionScript class fetches a JavaScript payload from a remotely-controlled URL (babRemoteScriptUrl in config) and then injects that payload into the active tab via chrome.tabs.executeScript with runAt:'d… | |
| 4 | Privilege Escalation | high | ntp1.html (line 25) | The hijacked new tab page loads a full-screen iframe that will be populated with hp.myway.com content. The iframe's 'allow' attribute grants the remote third-party page access to geolocation, microphone, camera, midi,… | |
| 5 | Privilege Escalation | high | js/webTooltabAPIProxy.js (line 147) | This content script turns remote pages on the extension's controlled new-tab/offer domains into command senders by forwarding `postMessage` payloads to the privileged background page. That creates a web-to-extension b… | |
| 6 | Privilege Escalation | high | js/webtooltabAPI.js (line 150) | The webtooltab API exposed to web pages includes privileged self-management actions such as `chrome.management.uninstallSelf`, with support for suppressing confirmation dialogs via caller-controlled options. In combin… | |
| 7 | Tracking | high | js/dlp.js (line 121) | The extension syncs a 'dlpToolbarData' object — containing tracking identifiers like toolbarId, partnerId, partnerSubId, installDate, countryCode, and pixel tracking URLs — across all of the user's synced Chrome profi… | |
| 8 | Tracking | high | js/background.js (line 451) | The extension establishes a recurring alarm (every 6 hours, per the 21600000ms interval in config.json) that fires a 'ToolbarActive' beacon to https://live.tb.ask.com/tr.gif. Each beacon carries the extension's CWS ID… | |
| 9 | Tracking | high | js/extensionDetect.js (line 108) | When the extension detects a navigation to any subdomain of .internetspeedutility.net, it injects this content script which: (1) writes two tracking cookies (mindsparktb_ and mindsparktbsupport_) keyed by the unique t… | |
| 10 | Tracking | high | config/config.json (line 22) | The configuration reveals an extensive affiliate/tracking pixel infrastructure. On installation the extension fires a pixel beacon containing the user's full affiliate chain (partnerId, partnerSubId, coId, toolbarId, … | |
| 11 | Tracking | high | js/dlp.js (line 86) | This code iterates over all tabs and frames, scrapes tracking parameters from URL hashes and query strings, and converts them into install-pixel and secondary-offer URLs. Reading campaign identifiers from arbitrary op… | |
| 12 | Tracking | high | js/extensionDetectWithHash.js (line 66) | When a visited page contains a matching install hash, the extension sends a `ToolbarDetect` beacon tied to the extension's toolbar ID and then forcibly redirects the active tab into the extension's new-tab page. This … | |
| 13 | Unauthorized Data Collection | high | js/localStorageContentScript.js (line 9) | This content script, injected into https://download.internetspeedutility.net/blank.jhtml, reads all localStorage keys from that page and transmits them back to the background script over a chrome.runtime port. When no… | |
| 14 | Unauthorized Data Collection | high | js/dlp.js (line 271) | The extension uses the 'cookies' permission to call chrome.cookies.getAll() on the .internetspeedutility.net domain, reading all cookies to extract tracking identifiers (toolbarId, partnerId, installDate, partnerSubId… | |
| 15 | Unauthorized Data Collection | high | js/watchExtensionsHandler.js (line 4) | The extension enumerates ALL installed extensions using chrome.management.getAll(), recording each extension's ID, version, and enabled state. It then registers persistent listeners for install, uninstall, enable, and… | |
| 16 | Unauthorized Data Collection | high | js/offerService.js (line 277) | The OfferService assembles a comprehensive device and user fingerprint — browser name/version, OS, platform, locale, language, userAgent, install date, country code, partner IDs, and user segment — and transmits it vi… | |
| 17 | Unauthorized Data Collection | high | js/background.js (line 95) | The extension implements a four-level cascade to extract tracking/affiliate parameters: (1) chrome.storage.sync, (2) cookies from the download domain, (3) localStorage from a silently-loaded tracking iframe, (4) URL h… | |
| 18 | Unauthorized Data Collection | high | js/dlpHelper.js (line 4) | The background page creates a hidden iframe to a remote web domain and waits for a content-script connection from that page so it can read back storage contents. This is a covert cross-origin collection pattern: the e… | |
| 19 | Tracking | medium | js/background.js (line 517) | The extension schedules recurring background telemetry pings to a remote endpoint and includes stable extension identifiers. The telemetry helper populates these events with toolbar ID and partner identifiers, turning… | |
| 20 | Unauthorized Data Collection | medium | js/watchExtensionsHandler.js (line 27) | The extension uses the powerful `management` permission to enumerate other installed extensions, record their IDs/versions, and determine which ones can override the new tab page. Monitoring competing extensions like … | |
