| 1 | Remote Code Loading | critical | js/babTypeInjectionScript.js (line 50) | The extension fetches a remote script from `extensionConfig.buildVars.babRemoteScriptUrl` (an arbitrary URL loaded at runtime from remote config) and stores it in `this.remoteScript`. On browser action click, this rem… | |
| 2 | Remote Code Loading | critical | js/babTypeInjectionScript.js (line 4) | On every initialization of the browser action click handler, the extension fetches a raw script body from a remotely-controlled URL (`babRemoteScriptUrl`). The script content is stored without validation and later inj… | |
| 3 | Remote Code Loading | critical | js/babTypeInjectionScript.js (line 50) | This code fetches a script from a remotely supplied URL earlier in the same file and then injects that raw source into the active tab with `chrome.tabs.executeScript`. That gives the operator remote code execution ins… | |
| 4 | Privilege Escalation | high | js/babTypeInjectionIframeAPIProxy.js (line 27) | Messages from the remote iframe are treated as commands and forwarded into extension callbacks such as content-script and background features. Because the trusted `targetOrigin` is paired with a remotely chosen iframe… | |
| 5 | Remote Code Loading | high | js/offerService.js (line 212) | The extension periodically contacts a remote 'offer service' URL (configurable remotely) and, if the server responds with an `offerURL`, opens that URL in a new tab. This gives the remote server the ability to silentl… | |
| 6 | Remote Code Loading | high | js/babRemoteConfigProcessor.js (line 14) | The extension creates a hidden iframe whose URL comes from remote configuration (`babConfig.proxyUrl`). That lets a server-side config swap in arbitrary remote content inside the privileged extension context and is es… | |
| 7 | Tracking | high | js/watchExtensionsHandler.js (line 70) | After enumerating extensions, the extension installs persistent lifecycle event listeners on the Chrome management API to track every other extension that is installed, uninstalled, enabled, or disabled. Each event is… | |
| 8 | Tracking | high | js/B2BService.js (line 4) | Every 8 hours the extension fires a 'PhoneHome' beacon to `tbapi.search.ask.com` and `apnanalytics.com` carrying a persistent unique `guid` (toolbarId), extension ID, install date, partner ID, sub-partner ID, and brow… | |
| 9 | Tracking | high | js/B2BService.js (line 145) | The extension creates a hidden iframe pointing at an external domain with `mode=write` to pre-register a tracking URL for when the user eventually uninstalls the extension. This is a covert write operation to an exter… | |
| 10 | Tracking | high | js/extensionDetect.js (line 117) | When injected into a web page, the content script sets two tracking cookies (`mindsparktb_<toolbarId>` and `mindsparktbsupport_<toolbarId>`) directly on the visited page's domain using `document.cookie`. These cookies… | |
| 11 | Unauthorized Data Collection | high | js/dlp.js (line 307) | The extension reads all cookies from an external domain using `chrome.cookies.getAll`, harvesting the full cookie jar for that domain. All cookie names and values are collected into a combined object (`cookiesObj`). W… | |
| 12 | Unauthorized Data Collection | high | js/dlp.js (line 184) | The extension injects an invisible iframe into the background page pointing at an external domain (`localStorageUrl`), then reads that domain's `localStorage` via a message channel established with a content script. T… | |
| 13 | Unauthorized Data Collection | high | js/dlpHelper.js (line 4) | Creates a hidden iframe to an external domain in the extension background page, then waits for a content script connection from that iframe to extract its localStorage. This covert iframe injection runs in the backgro… | |
| 14 | Unauthorized Data Collection | high | js/watchExtensionsHandler.js (line 4) | The extension uses the `management` permission to enumerate all installed browser extensions, recording each competing extension's ID, version, and enabled status. It then registers listeners for install, uninstall, e… | |
| 15 | Unauthorized Data Collection | high | js/localStorageContentScript.js (line 9) | This content script can dump either selected keys or the entire `window.localStorage` of the page it runs on and send it back over an extension port. Combined with the manifest's injection into `https://download.motit… | |
| 16 | Tracking | medium | js/ul.js (line 7) | Every telemetry/analytics event (ToolbarActive, Info, Error, InstallerFinished) includes a persistent unique toolbar ID (`anxt`), partner ID, sub-partner ID, coID, user segment, build version, and a timestamp. This da… | |
| 17 | Tracking | medium | js/background.js (line 547) | The extension sets up a recurring periodic alarm (`livePing`) that continuously sends 'ToolbarActive' beacons to a remote analytics URL. Each ping includes the Chrome extension ID (`cwsid`) and standard user-identifyi… | |
| 18 | Tracking | medium | js/B2BService.js (line 122) | The extension emits tracking beacons by constructing analytics URLs and loading them as images. In the same file, `getReportingParams()` populates these requests with persistent identifiers such as partner ID, toolbar… | |
| 19 | Unauthorized Data Collection | medium | js/offerService.js (line 321) | The OfferService collects and sends a rich device fingerprint including browser name/version, OS, platform, language/locale, full user-agent string, install date, country code, and multiple user/partner identifiers to… | |
| 20 | Unauthorized Data Collection | medium | js/dlp.js (line 46) | The extension queries all open tabs and all frames within each tab via `chrome.webNavigation.getAllFrames`, inspecting the full URL and hash fragment of every frame across all windows. While scoped by a regex match, t… | |
| 21 | Unauthorized Data Collection | medium | js/watchExtensionsHandler.js (line 27) | Using the `management` permission, the extension inventories other installed extensions, capturing their IDs, versions, enabled state, and overlapping permissions. Monitoring competing extensions and default-handler c… | |
