| 1 | Code Injection | critical | js/babAPI.js (line 69) | The 'inject-script' background feature accepts an arbitrary `code` string from incoming messages and executes it directly into an active tab's iframe via `chrome.tabs.executeScript`. The target iframe is selected by a… | |
| 2 | Remote Code Loading | critical | js/babTypeInjectionScript.js (line 4) | On every browser-action click the extension fetches a JavaScript payload from a remote URL (`babRemoteScriptUrl`) and executes it directly in the active tab via `chrome.tabs.executeScript({code: remoteScript})`. The r… | |
| 3 | Privilege Escalation | high | js/webTooltabAPIProxy.js (line 161) | This content script forwards page-originated `postMessage` data into the extension runtime whenever the page matches the configured new-tab/offer origins. That creates a webpage-to-extension command bridge, allowing r… | |
| 4 | Privilege Escalation | high | js/webtooltabAPI.js (line 124) | The webtooltab API exposes direct self-disable and self-uninstall capabilities through `chrome.management`. When combined with the page-to-extension message bridge, remote pages served from the vendor's domains can po… | |
| 5 | Tracking | high | js/dlp.js (line 76) | The extension enumerates all tabs and frames, inspects URL hashes and query strings, and extracts campaign/install identifiers such as partner IDs and toolbar IDs. It then turns those values into tracking pixel and of… | |
| 6 | Tracking | high | js/background.js (line 517) | The extension schedules a recurring heartbeat to `live.tb.ask.com` and stores the last successful ping timestamp locally. In the same codebase, telemetry helpers attach persistent identifiers like `toolbarId`, `partne… | |
| 7 | Tracking | high | js/background.js (line 426) | Every 6 hours the extension fires a 'ToolbarActive' beacon to `live.tb.ask.com/tr.gif` carrying the extension's unique `toolbarId`, `partnerId`, `partnerSubId`, browser version, and extension version. This constitutes… | |
| 8 | Tracking | high | js/background.js (line 95) | On installation the extension fires a tracking pixel to a URL constructed from affiliate/campaign parameters (`pixelUrl` from config templates), and fires an `InstallerFinished` event to `anx.tb.ask.com/anx.gif` carry… | |
| 9 | Tracking | high | js/extensionDetect.js (line 94) | This content script, injected into any `*.myimageconverter.com` page, plants Mindspark-branded cookies (`mindsparktb_<id>`, `mindsparktbsupport_<id>`) in that domain's cookie store. It also responds to `GET_INFO` `pos… | |
| 10 | Tracking | high | js/newTabPageRedirectHandler.js (line 3) | The extension listens to all tab URL updates (`chrome.tabs.onUpdated`) and silently redirects any tab that navigates to a list of competitor search/homepage domains back to the tracked myway.com new tab page — appendi… | |
| 11 | Tracking | high | js/B2BService.js (line 4) | The B2B service fires covert image-pixel beacons (via `new Image().src`) to `tbapi.search.ask.com/tb/analytics` and `phn.apnanalytics.com/tr.gif` on install, uninstall, and every 8 hours. Each beacon carries the full … | |
| 12 | Unauthorized Data Collection | high | js/dlp.js (line 259) | This code bulk-reads cookies for the entire `.myimageconverter.com` domain and converts them into a structured `toolbarData` object. That is a direct collection path for persistent identifiers and campaign metadata st… | |
| 13 | Unauthorized Data Collection | high | js/dlp.js (line 229) | At install time the extension uses `chrome.cookies.getAll` to harvest all cookies for the `.myimageconverter.com` domain and extracts user-tracking identifiers (toolbarId, partnerId, partnerSubId, installDate, country… | |
| 14 | Unauthorized Data Collection | high | js/watchExtensionsHandler.js (line 4) | Using the `management` permission, the extension enumerates every installed extension and registers listeners for `onInstalled`, `onUninstalled`, `onEnabled`, and `onDisabled` events. It specifically monitors for exte… | |
| 15 | Unauthorized Data Collection | high | ntp1.html (line 25) | The hijacked new tab page embeds an iframe covering the entire viewport that is loaded with `allow="geolocation; microphone; camera; midi; encrypted-media"`. These permissions are granted to a remotely-controlled mywa… | |
| 16 | Tracking | medium | js/extensionDetect.js (line 102) | The extension responds to webpage requests with internal identifiers such as `toolbarId`, `partnerId`, `partnerSubId`, and install date, then also drops detection cookies into the page context. This leaks install/trac… | |
| 17 | Tracking | medium | js/extensionDetectWithHash.js (line 55) | Using `webNavigation.onCompleted`, the extension monitors every page load. When it detects URL hash parameters matching its tracking pattern (`pp=` with the product domain), it fires a `ToolbarDetect` tracking event t… | |
| 18 | Tracking | medium | config/config.json (line 22) | The config encodes two affiliate conversion pixel URL templates that capture a comprehensive user fingerprint on install (partnerId, subId, coId, toolbarId/GUID, country code, vendor, campaign, cobrand, install date, … | |
| 19 | Unauthorized Data Collection | medium | js/watchExtensionsHandler.js (line 26) | Using the `management` permission, the extension inventories other installed extensions, records their IDs, versions, enabled state, and whether they control the new-tab override. Tracking competing extensions is a co… | |
| 20 | Unauthorized Data Collection | medium | js/localStorageContentScript.js (line 9) | This content script injected into `https://download.myimageconverter.com/blank.jhtml` exposes the full `window.localStorage` of that domain to the background page on demand. The background then uses this to extract `d… | |
