| 1 | Code Injection | critical | js/contentScript.js (line 1) | Arbitrary HTML returned by the remote server at /yhc is directly injected into the current page's DOM via jQuery append. The injected content (floating ad overlays, iframe-based ads) is entirely server-controlled and … | |
| 2 | Code Injection | critical | js/contentScript.js (line 66) | The extension treats server responses as trusted instructions, parses each item, and directly injects `item.html` into arbitrary page DOM locations chosen by the server. This enables remote UI/script-capable markup in… | |
| 3 | Data Exfiltration | critical | js/contentScript.js (line 1) | On every page load where the URL matches the server-controlled target list, the content script base64-encodes the full current page URL (window.location.href including path and query parameters) and the tab title, the… | |
| 4 | Unauthorized Data Collection | critical | js/utils.js (line 1) | The extension fetches the user's external IP address from the remote server at https://apis.yhchj.com/ip, then combines it with a full browser fingerprint (canvas, WebGL, fonts, userAgent, screen resolution, timezone,… | |
| 5 | Phishing | high | js/background.js (line 56) | The background page stores an externally supplied URL and opens it when the notification is clicked. Since notifications are populated from message data originating in server-driven ad objects, the backend can push ar… | |
| 6 | Remote Code Loading | high | js/utils.js (line 1) | The extension periodically calls the remote /version endpoint, sending browser type, extension version, geographic area, and IP address. The server responds with a dynamic URL target list that controls which websites … | |
| 7 | Tracking | high | js/utils.js (line 1) | The fp2Log function uses a 1x1 pixel image beacon (new Image; r.src = EpUrl + params) to silently transmit tracking data to https://apis.yhchj.com/ep.gif. The yhc_track function fires this beacon with a user UUID, tim… | |
| 8 | Tracking | high | js/utils.js (line 1) | The getStat function assembles a telemetry payload containing the persistent UUID, browser type (bid), extension version (vid), plugin/product version (pid), event ID (eid), and timestamp, then sends it via GET to the… | |
| 9 | Tracking | high | js/fp2.js (line 1847) | The extension hashes fingerprint components into a stable `uuid`, stores it in local extension storage, and immediately reuses it for tracking events. This creates a persistent identifier that survives page navigation… | |
| 10 | Unauthorized Data Collection | high | manifest.json (line 29) | The content script runs at document_start (before DOM is built) on every HTTP and HTTPS page across all frames, with broad host access to all URLs. The exclusions notably carve out Chinese government sites (.gov.cn) a… | |
| 11 | Unauthorized Data Collection | high | js/contentScript.js (line 41) | On matched pages, the content script collects the full tab URL, page title, a persistent UUID, and stored browser/version metadata, then sends it to the backend. Because the extension runs on `<all_urls>` at `document… | |
| 12 | Unauthorized Data Collection | high | js/fp2.js (line 1614) | This fingerprinting code enumerates high-entropy browser/device features such as plugins, canvas output, WebGL characteristics, and anti-spoofing signals. Those signals are commonly used to build resilient device fing… | |
| 13 | Tracking | medium | js/background.js (line 1) | On extension install, a beacon fires to apis.yhchj.com/ep.gif with campaign ID 31, browser type, and a timestamped UUID, registering the new install with the tracking server. chrome.runtime.setUninstallURL is also set… | |
| 14 | Tracking | medium | js/fp2.js (line 1783) | Tracking data is exfiltrated through a beacon image request to `https://apis.yhchj.com/ep.gif`, with all query fields appended into the URL. This is a covert analytics pattern that avoids normal XHR visibility while t… | |
