| 1 | Code Injection | critical | js/background.js (line 1) | Immediately upon installation, the extension queries ALL currently open browser tabs (not just the active one) and attempts to inject 'js/content.js' into every tab including all iframes (allFrames:true). The file 'js… | |
| 2 | Obfuscation | critical | js/background.js (line 1) | A heavily obfuscated function dynamically constructs a URL by concatenating string fragments scattered through outer-scope variables, then makes a fetch call with a dynamically computed HTTP method and optional JSON b… | |
| 3 | Obfuscation | critical | js/background.js (line 1) | The obfuscated Zr function reads a timestamp from chrome.storage.local and compares it against a hardcoded threshold (~86 million, approximately 1000 days in seconds) to decide when to trigger the nG network call and … | |
| 4 | Phishing | critical | js/background.js (line 1) | URLs received from the remote extinsight.com server are used to forcibly open new tabs on install, update, and Chrome update events by calling chrome.tabs.create. The URL template supports {crx_id} and {crx_version} s… | |
| 5 | Privilege Escalation | critical | js/background.js (line 1) | Upon installation, the extension immediately queries all currently open browser tabs and injects `js/content.js` into every tab with `allFrames: true`, silently and without user interaction. This grants code execution… | |
| 6 | Privilege Escalation | critical | js/background.js (line 1) | On first install, the background service worker queries ALL open browser tabs and injects 'js/content.js' into every single tab across all frames using chrome.scripting.executeScript. This bulk injection happens silen… | |
| 7 | Remote Code Loading | critical | js/background.js (line 1) | An embedded third-party SDK ('extinsight') contacts api1.extinsight.com with the extension's runtime ID to fetch a remote configuration object, which is cached in local storage and refreshed every 24 hours. The remote… | |
| 8 | Privilege Escalation | high | js/background.js (line 1) | An obfuscated alarm is created with a computed interval, and its onAlarm listener calls chrome.runtime.reload() to force-restart the extension on a recurring schedule. This self-reload mechanism resets state and re-ex… | |
| 9 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID ('cid') stored in chrome.storage.local and sends it to Google Analytics via a pageview hit every time the background script runs. A recurring alarm ('ga3') is created to fire … | |
| 10 | Tracking | high | js/background.js (line 1) | The extension generates and persistently stores a UUID as a client identifier (`cid`) in `chrome.storage.local`, then sends a Google Analytics pageview hit to `https://www.google-analytics.com/collect` on every backgr… | |
| 11 | Tracking | high | js/background.js (line 1) | The extension silently generates a persistent UUID ('cid') and stores it in chrome.storage.local, then sends it to Google Analytics (UA-209756648-1) via a POST to https://www.google-analytics.com/collect on every back… | |
| 12 | Tracking | high | js/background.js (line 1) | On first install, the extension opens a new tab to https://ladnet.co/<extension_runtime_id>/thanks.html, embedding the extension's unique runtime ID in the URL — allowing the ladnet.co server to fingerprint and log ea… | |
| 13 | Unauthorized Data Collection | high | js/background.js (line 1) | The background script uses `chrome.tabs.captureVisibleTab` to take a full PNG screenshot of the currently visible tab during color picking, and sends the entire screenshot data URI to the content script via message pa… | |
| 14 | Unauthorized Data Collection | high | js/background.js (line 1) | A serialized function 'ij' is injected into the active tab via chrome.scripting.executeScript to read all CSS custom properties from the page's stylesheets and return their computed color values. This constitutes unau… | |
| 15 | Unauthorized Data Collection | high | js/background.js (line 1) | The background service worker captures screenshots of the current tab via chrome.tabs.captureVisibleTab and transmits the full PNG data as a base64 string to the content script. Additionally, the 'set-color' handler r… | |
| 16 | Unauthorized Data Collection | high | js/picker.js (line 2) | When the dropper is activated, the content script tracks the user's scroll position continuously and requests screenshots of the visible tab on every scroll event via the background service worker. This results in a r… | |
| 17 | Code Injection | medium | js/popup.js (line 1) | This function creates a script element, sets its text to an arbitrary string passed as a parameter, appends it to the document head to execute it, then removes it. While this pattern originates from jQuery's internal … | |
| 18 | Tracking | medium | js/background.js (line 1) | On first install, the extension automatically opens a tab to `https://ladnet.co/<extensionId>/thanks.html`, embedding the extension runtime ID in the URL and notifying the third-party `ladnet.co` domain of the install… | |
| 19 | Tracking | medium | js/background.js (line 1) | The extension silently sends a Google Analytics Measurement Protocol beacon (UA-209756648-1) on every background page load, transmitting a persistent client ID (stored in chrome.storage.local as 'cid') alongside the e… | |
| 20 | Tracking | medium | js/background.js (line 1) | A persistent unique identifier (UUID) is generated and stored in chrome.storage.local under the key 'cid'. This ID is included in every analytics ping sent to Google Analytics, effectively creating a persistent finger… | |
| 21 | Tracking | medium | js/background.js (line 1) | On installation the extension opens a tab to 'https://ladnet.co/{extension_id}/thanks.html' and sets an uninstall URL to 'https://ladnet.co/{extension_id}/uninstall.html', transmitting the extension runtime ID to the … | |
| 22 | Unauthorized Data Collection | medium | js/picker.js (line 1) | Screenshot data (a full PNG of the visible tab) received from the background script is drawn onto an off-screen canvas and pixel data is extracted via getImageData. This pixel buffer persists in memory in the content … | |
| 23 | Unauthorized Data Collection | medium | js/popup.js (line 1) | The popup retrieves a browsing history of page URLs where the user previously picked colors, sent via the background service worker's 'getHistory' action. The active tab URL is also queried on every popup open. This c… | |
| 24 | Unauthorized Data Collection | medium | js/background.js (line 1) | The 'set-color' message handler passes lM.sender.url (the full URL of the originating page) into the setColor/saveToHistory pipeline. Although the final historyColorItem constructor does not currently serialize the UR… | |
| 25 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension calls chrome.tabs.captureVisibleTab() to take a full PNG screenshot of the active tab and transmits the base64-encoded image data to the content script via sendMessage. While screenshot capture is functi… | |
| 26 | Code Injection | low | js/picker.js (line 1) | Color data derived from canvas pixel sampling is written directly to `innerHTML`. While the values are numeric/hex and exploitation is unlikely in practice, use of `innerHTML` for any dynamic content is a risky patter… | |
| 27 | Unauthorized Data Collection | low | html/popup.html (line 1) | The popup HTML includes a 'Webpage Palette' section that displays colors extracted from the currently active webpage. This feature silently scans and extracts color data from any page the user visits on every popup op… | |
