| 1 | Network Interception | critical | js/background.js (line 604) | The `Z` function is registered as a `webRequest` blocking listener (via the dynamic `V.task()` mechanism) and intercepts all `main_frame` GET requests. For hosts matching server-supplied rules in `X`, it rewrites the … | |
| 2 | Network Interception | critical | js/background.js (line 604) | The Z function serves as a webRequest listener that redirects user traffic to arbitrary URLs based on rules provided by a remote command-and-control server. This is a clear indicator of traffic hijacking or ad injecti… | |
| 3 | Remote Code Loading | critical | js/background.js (line 449) | The `V.task()` function reads server-controlled property names (`w`, `r`, `a`) from storage key `ed` and uses them to dynamically invoke any Chrome API method as `chrome[w][r][a](Z, r, i)`. Because `U.g = chrome`, the… | |
| 4 | Remote Code Loading | critical | js/background.js (line 825) | The `severyday` handler receives a Base64-encoded payload from `fanyi.ocanou.com`, decodes and parses it as JSON, and if it contains a `version.r` key, stores that data under `ed` and immediately calls `V.task()`. Thi… | |
| 5 | Remote Code Loading | critical | js/background.js (line 449) | The extension implements a dynamic command execution mechanism where parameters fetched from a remote server are used to call internal chrome.* APIs. This allows the remote server to perform any action the extension h… | |
| 6 | Remote Code Loading | critical | js/content.js (line 61) | The content script acts as a bridge for remote code execution by fetching a payload from a remote server and passing it back to the background script's 'severyday' handler, which decodes and executes the instructions.… | |
| 7 | Data Exfiltration | high | js/background.js (line 779) | The `everyday` handler fetches remote config from `http://fanyi.ocanou.com/vocabulary.json` and stores the response (including redirect rules `X`) in persistent local storage. The URL is constructed in `content.js` fr… | |
| 8 | Privilege Escalation | high | js/content.js (line 82) | The content script accepts arbitrary `window.postMessage` messages from any web page (no origin check) with `from == 'page'` and forwards them directly to the privileged background via `chrome.runtime.sendMessage`. Re… | |
| 9 | Tracking | high | js/background.js (line 310) | The `F.log` function beacons arbitrary event data to `http://fanyi.ocanou.com/log.json` using a covert 1×1 image request, transmitting the user's persistent UUID (`u`/`z`), browser channel, install count, page URLs, a… | |
| 10 | Tracking | high | js/background.js (line 310) | The extension exfiltrates user identifiers (gid), channel information (chne), and version data to a remote server (fanyi.ocanou.com) via tracking pixels. This is done without explicit user consent for tracking. | |
| 11 | Unauthorized Data Collection | high | js/background.js (line 861) | The `getExtInfo` handler calls `chrome.management.getAll()` to enumerate every installed browser extension and returns the full list. This data is accessible to the background page and can be exfiltrated via the `F.lo… | |
| 12 | Network Interception | medium | js/background.js (line 871) | The extension uses `webRequestBlocking` to intercept and silently strip the `Cookie` header on all requests to `https://cn.bing.com/*` before they are sent, replacing the cookie value with `"0"`. While the stated purp… | |
| 13 | Remote Code Loading | medium | manifest.json (line 19) | The manifest explicitly opts into `unsafe-eval`, permitting `eval()`, `new Function()`, and `setTimeout(string)` calls within the extension's privileged pages. Combined with the remote config channel that can deliver … | |
