| 1 | Privilege Escalation | critical | background.js (line 1) | On installation the extension immediately queries ALL open browser tabs with no filter and programmatically injects inject.js into every matching tab (any http://, https://, or file:/// URL except the Chrome Web Store… | |
| 2 | Remote Code Loading | critical | js/background.js (line 673) | The extension includes the ExtInsight SDK which fetches remote configuration to dynamically set and open URLs on install, update, and uninstall events. This behavior is used for unauthorized tracking of extension life… | |
| 3 | Unauthorized Data Collection | critical | manifest.json (line 1) | The manifest injects moment.js (a 54KB date/time formatting library with no theming functionality whatsoever) as a content script into every URL at document_start before any page content loads. A legitimate dark theme… | |
| 4 | Code Injection | high | background.js (line 3) | On installation, the extension immediately calls chrome.tabs.query({}) with no filter — retrieving all open tabs across all windows — and then programmatically executes inject.js into every matching tab. This aggressi… | |
| 5 | Obfuscation | high | js/proxy.js (line 113) | The extension injects a script into the MAIN world that hooks multiple core DOM and CSSOM methods (e.g., addRule, styleSheets, getElementsByTagName) to hide its injected styles from website scripts. This stealthy beha… | |
| 6 | Other | high | js/background.js (line 672) | The extension pulls remote JSON from `api1.extinsight.com` and uses it to control install/update tabs and the uninstall URL. That gives a remote service post-publication control over user navigation and uninstall call… | |
| 7 | Other | high | js/background.js (line 663) | The background script contacts a remote service (`api1.extinsight.com`) to retrieve extension behavior/configuration at runtime, then caches the response locally. This introduces server-side control over extension act… | |
| 8 | Phishing | high | inject.js (line 1) | The Relax class injects a full-screen fixed `<div>` overlay with `z-index: 2147483647` (maximum possible) covering 120% of the viewport into every page's documentElement before page content loads. While currently `poi… | |
| 9 | Privilege Escalation | high | background.js (line 2) | On installation, the extension immediately queries ALL open tabs and programmatically injects inject.js into every tab whose URL matches http/https/file schemes. This bulk injection across every open tab at install ti… | |
| 10 | Remote Code Loading | high | background.js (line 1) | A script element is dynamically created and inserted into the background page to load the Google Analytics library from an external CDN at runtime. This is a remote code loading pattern: the code executed in the exten… | |
| 11 | Remote Code Loading | high | background.js (line 1) | The background page dynamically loads and executes a remote script from `www.google-analytics.com` inside the extension's privileged context, then immediately sends an analytics pageview. Remote code loading from a ba… | |
| 12 | Remote Code Loading | high | background.js (line 1) | The background script dynamically loads a remote JavaScript file (analytics.js) from an external domain at runtime and executes it in the privileged extension background page context. The content of analytics.js is en… | |
| 13 | Remote Code Loading | high | popup.js (line 2) | The bundled jQuery 3.4.1 in popup.js includes `_evalUrl` — a function that fetches an arbitrary URL and executes the returned JavaScript via `w.globalEval` inside the extension popup context. While this is part of the… | |
| 14 | Tracking | high | js/background.js (line 688) | URLs supplied by the remote ExtInsight response are opened automatically on install/update and also registered as the uninstall callback. Because those URLs are remotely controlled and parameterized with the extension… | |
| 15 | Tracking | high | background.js (line 1) | The background script initializes Google Analytics tracking (UA-192082297-1) and deliberately sets checkProtocolTask to null — a known bypass to suppress GA's protocol validation so it fires from a chrome-extension://… | |
| 16 | Tracking | high | background.js (line 1) | The background script initializes a Google Analytics tracker (UA-192082297-1) and immediately sends a pageview hit for '/background', then dynamically injects analytics.js from google-analytics.com. Critically, `ga('s… | |
| 17 | Tracking | high | background.js (line 1) | The background page silently initializes Google Analytics (tracking ID UA-192082297-1) and dynamically injects the remote analytics.js script from google-analytics.com. The call `ga("set","checkProtocolTask",null)` de… | |
| 18 | Tracking | high | manifest.json (line 1) | The manifest's Content Security Policy explicitly allowlists Google Analytics (google-analytics.com) and Google Tag Manager (googletagmanager.com) as permitted script sources for the extension's privileged pages. A da… | |
| 19 | Unauthorized Data Collection | high | js/background.js (line 654) | Inclusion of the ExtInsight SDK which fetches dynamic configuration from an external server (api1.extinsight.com) and tracks extension installation/update events. This SDK is known for collecting user browsing data an… | |
| 20 | Unauthorized Data Collection | high | inject.js (line 1) | The content script explicitly enumerates and targets highly sensitive web services including Gmail, Google Drive, Google Docs, Google Calendar, WhatsApp Web, and Facebook Messenger. Combined with the <all_urls> permis… | |
| 21 | Unauthorized Data Collection | high | manifest.json (line 1) | The extension injects moment.js (54KB date/time library) as a content script into every page at document_start, yet inject.js makes zero calls to moment — it uses native new Date() directly. This unjustified library i… | |
| 22 | Code Injection | medium | inject.js (line 1) | CSS content is fetched from extension resources and injected as text nodes into `<style>` elements in the DOM of sensitive pages including Gmail, Google Drive, Facebook Messenger, and WhatsApp Web. CSS injection into … | |
| 23 | Other | medium | manifest.json (line 1) | The manifest injects `moment.js` (a date manipulation library) at `document_start` on every URL visited by the user. Examination of `inject.js` shows it uses only `new Date()` natively and has zero functional dependen… | |
| 24 | Other | medium | background.js (line 1) | The background script bundles the full RxJS library (~100KB), including WebSocket (webSocket, WebSocketSubject), AJAX (ajax, AjaxError, AjaxResponse), and fromFetch utilities. A dark-theme CSS-injection extension has … | |
| 25 | Privilege Escalation | medium | manifest.json (line 19) | Broad host permissions (<all_urls>) combined with the scripting permission allow the extension to inject code into any website the user visits. The js/proxy.js script is also made web-accessible and injected into the … | |
| 26 | Privilege Escalation | medium | js/background.js (line 5384) | This message handler lets the content script ask the privileged background worker to fetch an arbitrary URL and return the response. With `<all_urls>` host access, this is effectively a network proxy capability that b… | |
| 27 | Privilege Escalation | medium | inject.js (line 1) | The full-screen overlay injected on all pages is entirely controlled by chrome.storage changes and runtime messages. Any update to the extension or a compromised background script could modify the overlay's `pointer-e… | |
| 28 | Tracking | medium | js/background.js (line 34) | The extension generates and stores a persistent UUID-like client ID in local storage, then sends it to Google Analytics as a recurring background "pageview". This is a tracking pattern rather than core dark-theme func… | |
| 29 | Tracking | medium | js/background.js (line 33) | The extension creates and persists a unique client ID in `chrome.storage.local` and transmits it to Google Analytics from the background worker. This is a persistent cross-session identifier and constitutes user/insta… | |
| 30 | Tracking | medium | background.js (line 1) | The background bundle imports dayjs (a date/time library) and exposes a URL hostname extraction function (Pz). A date/time library has no legitimate purpose in a dark theme's background script; its presence alongside … | |
| 31 | Unauthorized Data Collection | medium | inject.js (line 1) | The script contains a separate DOMContentLoaded listener that reads document.location.href on every page load to extract the hostname and applies a hardcoded special-case check specifically for 'facebook.com' with a d… | |
| 32 | Unauthorized Data Collection | medium | inject.js (line 1) | The content script captures the full page URL (`document.location.href`) on every page load across all URLs and all iframes (`all_frames: true`, `match_about_blank: true`). While the URL is used locally for CSS select… | |
| 33 | Unauthorized Data Collection | medium | inject.js (line 1) | The content script extracts the full page URL from `document.location.href` on every page load at document_start and matches it against a hardcoded list of sensitive platforms including Gmail, Google Drive, WhatsApp, … | |
| 34 | Unauthorized Data Collection | medium | popup.js (line 4) | The popup reads the active tab URL via `chrome.tabs.query` and writes derived content to `domainBtn.innerHTML` without sanitization, creating a potential XSS vector if a tab URL contains crafted content that survives … | |
| 35 | Code Injection | low | js/background.js (line 5473) | The extension injects a script into the page's MAIN world on every site, in every frame, at `document_start`. Main-world injection is more invasive than isolated-world content scripts because it can directly modify pa… | |
| 36 | Code Injection | low | inject.js (line 1) | The content script reads the blacklist from chrome.storage and conditionally adds the class __fb-dark-mode to document.body on Facebook. Notably, the outer DOMContentLoaded handler is wrapped in an if() with no condit… | |
| 37 | Other | low | inject.js (line 1) | The variable 'blacklist' is assigned without a var/let/const declaration inside a closure (blacklist=rP.blacklist), creating an implicit global variable on every page the content script executes. In a content script c… | |
| 38 | Tracking | low | js/background.js (line 48) | Usage of Google Analytics to track background page views and extension usage, including a unique client ID (cid) stored in local storage. | |
