mobile browser emulator

The extension enumerates and permanently deletes ALL cookies for the target domain, including session tokens, authentication cookies, and stored credentials. This function is called both when opening and closing a mobile emulation window (lines 77 and 124), meaning the user's authenticated session on the target site is silently destroyed twice per use without any explicit warning about data loss.

function remove_allCookies(dmn) {  chrome.cookies.getAll({    url: dmn  }, function(cookies) {    var path;    for (var i = 0; i < cookies.length; i++) {      path = "http" + (cookies[i].secure ? "s" : "") + "://" + cookies[i].domain + cookies[i].path;      chrome.cookies.remove({        url: path,        name: cookies[i].name      });    }  });}

The extension registers a blocking webRequest listener on all URLs to intercept and modify outgoing HTTP request headers for every request made by the emulated tab. In addition to replacing the User-Agent, it silently appends a `Cache-Control: no-cache` header to all requests. The use of `webRequestBlocking` with `<all_urls>` gives full read/write access to all HTTP request headers sent by the tab, including authorization tokens and cookies transmitted in headers.

chrome.webRequest.onBeforeSendHeaders.addListener(function(details) {  var rh = details.requestHeaders;  blockingResponse = {};  for (var i = 0; i < rh.length; i++) {    if (rh[i].name == "User-Agent") {      rh[i].value = uA[dev];      break;    }  }  var nc = new Object();  nc.name = "Cache-Control";  nc.value = "no-cache";  rh.push(nc);  blockingResponse.requestHeaders = rh;  return blockingResponse;}, {  urls: ["<all_urls>"],  tabId: t}, ["requestHeaders", "blocking"]);

This script is injected into every emulated page and uses the deprecated `navigator.__defineGetter__` API to permanently override the page's native `navigator.userAgent` property. The injected script text is constructed by concatenating the `nua` variable (set by a prior executeScript call in background.js line 99), creating an indirect code injection chain. The use of `setTimeout("get_head()",5)` passes a string to setTimeout, which is equivalent to eval and executes arbitrary code as a string.

var el = document.createElement("script");el.type = "text/javascript";el.text = "navigator.__defineGetter__(\"userAgent\",function(){return \"" + nua + "\"})";get_head();function get_head() {  var tag = document.getElementsByTagName("head")[0];  if (!tag) setTimeout("get_head()", 5);  else tag.appendChild(el);}

The extension injects multiple scripts and CSS into all pages the user navigates to inside emulation windows using `document_start` timing (before the page loads). The injected code strings `"var nua='"+mobua+"'"` and `"var info='"+info+"'"` use string concatenation rather than safe parameter passing — if `mobua` or `info` contained a single quote or semicolon, arbitrary code could execute in the page context. This pattern of injecting globally-scoped variables into all pages is a classic code injection risk.

chrome.tabs.executeScript(t, {  runAt: start,  code: "var nua='" + mobua + "'"});chrome.tabs.executeScript(t, {  runAt: start,  file: "ua.js"});if (request.mbeBars) {  chrome.tabs.insertCSS(t, {    runAt: end,    file: "bars.css"  });  chrome.tabs.executeScript(t, {    runAt: end,    file: "bars.js"  });  if (request.mbeBars) chrome.tabs.executeScript(t, {    runAt: "document_idle",    code: "show_bars(" + param[2] + ")"  });}chrome.tabs.insertCSS(t, {  runAt: start,  file: "screen.css"});chrome.tabs.executeScript(t, {  runAt: start,  code: "var info='" + info + "'"});chrome.tabs.executeScript(t, {  runAt: end,  file: "screen.js"});

The extension loads an external page (`http://tools.diorama.ch/mbe_block.html`) over unencrypted HTTP when detecting certain streaming service URLs in the active tab. Loading external content over plain HTTP allows a network-level attacker (MITM) to inject arbitrary HTML/JavaScript into the popup shown to the user. The hardcoded blocklist targeting specific high-value streaming domains (Netflix, Spotify) is also suspicious — this pattern is sometimes used to avoid security scrutiny from high-profile sites while still intercepting other traffic.

function check_blockedUrls(u) {  if (/netflix\.|spotify\.|sonyentertainmentnetwork\.|blim\./.test(u)) {    urlBlock = true;    chrome.windows.create({        url: "http://tools.diorama.ch/mbe_block.html",        type: 'popup',        width: 460,        height: 285,        top: 100,        left: (screen.availWidth - 460) / 2,        focused: focus      },      function() {}    )  } else urlBlock = false;}

The extension injects CSS directly into the user's original source tab (the page they were browsing) to visually dim it, and simultaneously deletes all cookies for that domain. While the opacity change is cosmetic, the extension is modifying content on any page the user visits by injecting CSS without clear user consent for the content modification aspect. Combined with the cookie deletion occurring on both window open and close, the user's authenticated session state is destroyed on the pages they are actively visiting.

if (tabOpen == 0) {  srcTab = request.mbeTab.id;  chrome.tabs.insertCSS(srcTab, {    code: "body{opacity:0.2}"  });  remove_allCookies(url);}...if (tabOpen == 0) {  chrome.tabs.insertCSS(srcTab, {    code: "body{opacity:1}"  });  remove_allCookies(url);  clearTab = false;}