| 1 | Code Injection | critical | js/content.js (line 67) | The content script sends the full current page URL to a remote endpoint and then injects the server response directly into the live DOM of whatever site the user is visiting. That combines browsing-activity disclosure… | |
| 2 | Data Exfiltration | critical | js/background.js (line 1) | The extension silently beacons user telemetry to an external server at `http://calendar.itemev.com/log.json` using a 1x1 pixel Image object, which bypasses XHR visibility. The payload includes `uid` (persistent user i… | |
| 3 | Data Exfiltration | critical | js/background.js (line 1) | Every time a user's navigation is intercepted and redirected, the full original URL (`r:e.url`) along with the user's unique ID, account depth counter (`acd`), and session timestamps are reported back to the tracking … | |
| 4 | Network Interception | critical | js/background.js (line 310) | This function takes rule objects from previously downloaded remote data and installs them as dynamic `declarativeNetRequest` rules. That gives the remote server the ability to change network behavior on the fly, inclu… | |
| 5 | Network Interception | critical | js/background.js (line 1) | The `D` function is a webRequest intercept handler that silently redirects browser main-frame GET requests to server-controlled URLs. When rules in the remote config (`S`) match the visited domain, the function constr… | |
| 6 | Phishing | critical | js/background.js (line 540) | On every tab update, the extension consults the remote config object and can open a new tab or replace the current tab with a server-supplied URL. This is a classic remotely controlled redirect mechanism that could be… | |
| 7 | Remote Code Loading | critical | js/background.js (line 1) | The `M.task()` function reads a remote-controlled configuration object `ln` and dynamically calls a Chrome API method using property names supplied entirely by the server: `chrome[ln.value.w][ln.value.r][ln.value.a](D… | |
| 8 | Remote Code Loading | critical | js/background.js (line 1) | The `set_lunar` handler decodes a server response (custom reversed-base64 via `decodeURL`) and parses it as JSON to extract redirect rules and webRequest listener configuration. The decoded config is stored as `ln` an… | |
| 9 | Obfuscation | high | js/background.js (line 229) | The background script fetches an encoded configuration blob from `http://calendar.itemev.com/new/cab`, decodes it with a custom function, and loads it into a global runtime config object. This creates a remote control… | |
| 10 | Privilege Escalation | high | js/content.js (line 191) | This listener accepts `window.postMessage` input from the web page and forwards it to the extension runtime, then posts the privileged response back into the page context. Exposing the extension message channel to arb… | |
| 11 | Privilege Escalation | high | js/background.js (line 354) | The background page exposes a generic XHR primitive that can fetch attacker-chosen URLs and return the response body. Combined with the content script's page-to-extension message bridge and the extension's broad host … | |
| 12 | Remote Code Loading | high | js/content.js (line 1) | The content script's `appInit` function fetches a configuration payload from `http://calendar.itemev.com/festival.json` on every page load, including the user's persistent UID, channel, account depth, and version in t… | |
| 13 | Tracking | high | js/background.js (line 1) | The extension generates a persistent 32-character random UUID (`gid`) and stores it in both `localStorage` and `chrome.storage.local`. This persistent identifier is included in every tracking beacon and redirect URL s… | |
| 14 | Code Injection | medium | manifest.json (line 21) | The extension declares `'unsafe-eval'` in its Content Security Policy, which permits `eval()`, `new Function()`, and similar dynamic code execution methods. Combined with remotely-downloaded and decoded JSON configura… | |
| 15 | Network Interception | medium | js/background.js (line 1) | The extension uses `webRequestBlocking` to strip all cookie headers from requests to its own server at `calendar.itemev.com`. While appearing to be privacy-protecting, this is operational security for the malware: it … | |
