| 1 | Data Exfiltration | critical | js/bg.bundle.js (line 22479) | This code records page URLs from injected tabs, buffers them locally, and uploads the history list back to the extension's server with `_saveHistory()`. For a VPN/privacy-themed extension, collecting and exfiltrating … | |
| 2 | Data Exfiltration | critical | js/bg.bundle.js (line 1) | On initialization and on a regular schedule, the extension POSTs a beacon to analytics.savematik.com/ext-statistic/partners containing the extension_id, extension_version, OS platform, browser type, and user language.… | |
| 3 | Data Exfiltration | critical | js/bg.bundle.js (line 1) | Every time a user visits a merchant site, sendMerchantVisit() silently reports the merchant ID, offer ID, extension ID, OS, browser, and language to analytics.savematik.com. A parallel sendCouponsAnalyticsGA() functio… | |
| 4 | Network Interception | critical | js/bg.bundle.js (line 1) | The extension installs a PAC (Proxy Auto-Config) script via chrome.proxy.settings.set() that routes selected URLs through an operator-controlled proxy server. The proxy host, port, and site list are fetched from mallb… | |
| 5 | Tracking | critical | js/bg.bundle.js (line 1) | When a user visits a merchant site matching the extension's offer list, the extension silently rewrites the tab URL to redirect through an affiliate cashback link (sCashback.baseClick) encoding the merchant offer ID, … | |
| 6 | Unauthorized Data Collection | critical | js/bg.bundle.js (line 1) | The extension hard-codes an entire affiliate marketing backend at mallbery.com and a separate analytics server at analytics.savematik.com — neither disclosed in the extension's description or homepage (netsafe.su). Th… | |
| 7 | Code Injection | high | js/bg.bundle.js (line 1) | The Tab wrapper class provides injectScript() and injectCSS() methods that use chrome.scripting to inject arbitrary JS files or CSS into any tab by ID. Combined with the extension's <all_urls> host permissions, this e… | |
| 8 | Code Injection | high | js/page.bundle.js (line 1) | The page content script (injected into every web page) uses an obfuscated random message key ('rItLVd84ITBGs5ZaPs0SpymiW9d8VQYQ') to authenticate communications from the background service worker. Upon receiving Insta… | |
| 9 | Network Interception | high | js/bg.bundle.js (line 1) | The 'terminator' module attaches onBeforeRequest listeners covering all URLs (main_frame, sub_frame, image, script) for tabs visiting merchant sites. Every request's origin URL and timestamp are recorded into merchant… | |
| 10 | Privilege Escalation | high | js/bg.bundle.js (line 22850) | On startup, the extension iterates over installed extensions and disables any whose ID appears in `disableExtList` by calling `chrome.management.setEnabled(n, !1)`. Earlier in the same file, `disableExtList` is popula… | |
| 11 | Remote Code Loading | high | js/bg.bundle.js (line 1) | On every startup the extension fetches its configuration from mallbery.com/_getInstallData(), which remotely sets the affiliate partner IDs for cashback and search monetization, the user's detected IP address, and the… | |
| 12 | Unauthorized Data Collection | high | js/bg.bundle.js (line 14988) | The extension enumerates all installed extensions via `chrome.management.getAll()` and sends the full list of extension IDs to its analytics backend. Collecting a user's installed-extension inventory is highly sensiti… | |
| 13 | Unauthorized Data Collection | high | js/bg.bundle.js (line 1) | The extension's activation-params parser explicitly merges cookies, localStorage entries, and sessionStorage entries from merchant site configurations. This indicates the extension reads and aggregates stored site dat… | |
| 14 | Network Interception | medium | js/bg.bundle.js (line 21348) | The extension hooks `chrome.webRequest.onAuthRequired` and programmatically injects stored proxy credentials into authentication challenges. Combined with its global proxy settings and `<all_urls>` access, this gives … | |
| 15 | Other | medium | js/bg.bundle.js (line 1) | When the proxy is toggled, the extension reloads ALL currently open browser tabs by calling chrome.tabs.update() on every tab to force a page reload through the newly active or cleared proxy configuration. This forcib… | |
| 16 | Tracking | medium | js/bg.bundle.js (line 9891) | The extension sends persistent telemetry containing its extension identifier/version and additional user metadata (via `extendWithUserData`) to multiple analytics domains, including `analytics.savematik.com` and `anal… | |
