Multi Auto Refresh

The extension requests the '<all_urls>' and 'tabs' permissions, granting it broad access to the user's browsing activity across all websites. This is a high-privilege state that, combined with the auto-refresh functionality, could be abused for wide-scale monitoring or network-based attacks.

{  "permissions": [    "storage",    "alarms",    "tabs",    "<all_urls>"  ]}

The extension generates and persists a unique client ID in local storage, then sends it to Google Analytics along with the extension ID as a background pageview. This is a tracking pattern rather than overt malware, but it creates persistent telemetry for each install without any visible user consent flow.

const s = e("uuid");async function n() {  const e = await new Promise((e => {    chrome.storage.local.get(["cid"], (r => {      e(r)    }))  }));  let {    cid: r  } = e;  return r || (r = s.v4(), chrome.storage.local.set({    cid: r  })), r}async function a(e) {  const r = undefined,    t = {      v: "1",      tid: e,      cid: await n(),      t: "pageview",      dp: "/background",      dt: "background",      dh: `chrome-extension://${chrome.runtime.id}`    },    s = `https://www.google-analytics.com/collect?${new URLSearchParams(t).toString()}`;  await fetch(s, {    method: "POST",    body: ""  })}

The extension uses Google Analytics to track background pageviews, sending a unique client ID (cid) and extension information to a remote server (UA-198889555-1). While common, this constitutes data collection and tracking of the extension's lifecycle.

async function a(e) {  const r = undefined,    t = {      v: "1",      tid: e,      cid: await n(),      t: "pageview",      dp: "/background",      dt: "background",      dh: `chrome-extension://${chrome.runtime.id}`    },    s = `https://www.google-analytics.com/collect?${new URLSearchParams(t).toString()}`;  await fetch(s, {    method: "POST",    body: ""  })}

The extension requests permission to inject a content script into all URLs, all frames, and at document_start. However, the injected file 'js/content.js' is currently empty, which is suspicious and could serve as a placeholder for future malicious code injection.

{  "content_scripts": [    {      "matches": [        "http://*/*",        "https://*/*"      ],      "js": [        "js/content.js"      ],      "all_frames": true,      "match_about_blank": true,      "run_at": "document_start"    }  ]}

The manifest injects a content script into every HTTP and HTTPS page, all subframes, and even about:blank frames at document start. The shipped content script is empty, so this is not active abuse by itself, but it is an unusually broad early-execution footprint that would enable pervasive page access if later repurposed.

{  "update_url": "https://clients2.google.com/service/update2/crx",  "author": "Multi Auto Refresh team",  "background": {    "scripts": ["js/background.js"],    "persistent": true  },  "browser_action": {    "default_icon": {      "16": "icons/icon16.png",      "48": "icons/icon48.png",      "128": "icons/icon128.png",      "300": "icons/icon300.png"    },    "default_title": "__MSG_extName__",    "default_popup": "html/popup.html"  },  "content_scripts": [{    "matches": ["http://*/*", "https://*/*"],    "js": ["js/content.js"],    "all_frames": true,    "match_about_blank": true,    "run_at": "document_start"  }],

On installation, the background script enumerates all open tabs and forcibly injects the content script into every frame. Because `content.js` is empty, this currently does nothing observable, but the pattern is still noteworthy because it grants immediate execution across the user's active browsing session.

n.browser.runtime.onInstalled.addListener((async e => {  if ("install" === e.reason) {    const e = "js/content.js",      r = await n.browser.tabs.query({});    for (const t of r)      if (t.id) try {        await n.browser.tabs.executeScript(t.id, {          allFrames: !0,          file: e        })      } catch (e) {}  }}));let o = [];