| 1 | Code Injection | critical | b0.js (line 323) | `passf_url` follows HTTP redirects for a server-controlled URL and then injects the *final resolved URL* as an iframe into the target tab's `<head>` via `chrome.tabs.executeScript`. This is a redirect-following inject… | |
| 2 | Credential Theft | critical | b0.js (line 279) | The remote C&C server can instruct the extension to plant arbitrary cookies on any URL via `chrome.cookies.set`. The cookie name, value, and target URL are all attacker-controlled, enabling session fixation, authentic… | |
| 3 | Network Interception | critical | b0.js (line 371) | The extension strips `X-Frame-Options`, `Frame-Options`, and `Content-Security-Policy` headers from all sub-frame (iframe) responses across every website (`*://*/*`). This is a prerequisite for the remote iframe injec… | |
| 4 | Remote Code Loading | critical | b0.js (line 262) | On every tab URL change, the extension base64-encodes a local identifier and the full visited URL, posts them to a remote endpoint, and then executes server-supplied actions. The response can drive `chrome.tabs.execut… | |
| 5 | Remote Code Loading | critical | c1.js (line 4) | This content script receives selector/config objects from the background page and repeatedly executes them with `eval` on every matched website. Because those rules are fetched remotely, the operator can dynamically d… | |
| 6 | Remote Code Loading | critical | b0.js (line 254) | The C&C server's JSON response directly controls code and content injected into the user's active tabs. `result['a']` injects a server-controlled iframe URL into any tab's `<head>` via `chrome.tabs.executeScript`, `re… | |
| 7 | Unauthorized Data Collection | critical | b0.js (line 229) | Every tab URL change is captured and posted to the third-party C&C server at `https://d.langhort.com/chrome/TrackData/` along with a persistent local user ID, both base64-encoded. This runs on every browser navigation… | |
| 8 | Data Exfiltration | high | b0.js (line 168) | The background page relays session telemetry received from the content script — including `userId`, `sessionId`, `messagesCount`, `interactionsCount`, session `duration`, `videoId`, and `videoDuration` — to `https://d… | |
| 9 | Data Exfiltration | high | content_script.js (line 2025) | The content script collects detailed Netflix viewing session metadata (video ID, total duration, number of chat messages and user interactions, session duration) and exfiltrates it to the background page on every page… | |
| 10 | Network Interception | high | b0.js (line 403) | This listener strips `X-Frame-Options` and `Content-Security-Policy` headers from all subframe responses. Removing those protections is a classic network-interception pattern used to force third-party sites into ifram… | |
| 11 | Privilege Escalation | high | b0.js (line 301) | The same remote response can instruct the extension to make arbitrary network requests and set cookies for attacker-chosen URLs, names, and values. That gives a remote server direct influence over browser state across… | |
| 12 | Tracking | high | b0.js (line 114) | On first install, the extension contacts `https://data.langhort.com/create-userId` to obtain a server-assigned persistent tracking identifier, which is then stored locally and attached to every subsequent event and tr… | |
| 13 | Unauthorized Data Collection | high | b0.js (line 441) | The background page downloads remote scraping rules, collects the user's public IP address from a third-party geolocation service, and posts captured data to `unscart.in`. This is unauthorized data collection and exfi… | |
| 14 | Tracking | medium | b0.js (line 479) | The extension hooks YouTube network requests, extracts ad and content video identifiers, and forwards them into its analysis/exfiltration pipeline. Intercepting cross-site traffic unrelated to Netflix Party strongly s… | |
| 15 | Tracking | medium | b0.js (line 62) | On every fresh install the extension immediately opens a new tab to `https://ytdsh.in/npinstall` — a URL shortener redirect chain that is not the legitimate Netflix Party website. Combined with the install event being… | |
