| 1 | Data Exfiltration | critical | js/bg.js (line 19562) | The API service initializes by disabling TLS certificate validation entirely (NODE_TLS_REJECT_UNAUTHORIZED=0), making all network calls susceptible to MITM attacks. Additionally, the _saveHistory method silently POSTs… | |
| 2 | Network Interception | critical | js/bg.js (line 21140) | The extension intercepts proxy authentication challenges and injects stored proxy credentials into the browser's request flow. With `webRequestBlocking` on `<all_urls>`, this gives the operator direct control over aut… | |
| 3 | Network Interception | critical | js/bg.js (line 21320) | This code installs a PAC script that sends essentially all HTTP and HTTPS traffic through a remote proxy host returned by the service. That is a powerful traffic interception capability and allows the extension operat… | |
| 4 | Privilege Escalation | critical | js/bg.js (line 24145) | On startup, the extension fetches a remote-controlled 'disableExtList' from mallbery.com and uses chrome.management.setEnabled() to forcibly disable other installed extensions. This allows the remote operator to silen… | |
| 5 | Remote Code Loading | critical | js/bg.js (line 7796) | The extension silently contacts a hidden C2 infrastructure at mallbery.com (completely unrelated to netsave.su, the extension's stated domain). It fetches remote configuration including configs named 'thanos' and 'ter… | |
| 6 | Remote Code Loading | critical | js/bg.js (line 19369) | The extension loads a remote configuration from mallbery.com/config that dynamically enables/configures multiple tracking modules: sSearch (search monitoring), sVideo (video tracking), sClicks (click tracking), and hi… | |
| 7 | Unauthorized Data Collection | critical | js/bg.js (line 14881) | When analytics is enabled, the extension calls chrome.management.getAll() to enumerate every installed browser extension and exfiltrates the complete list of extension IDs via analytics. This constitutes unauthorized … | |
| 8 | Unauthorized Data Collection | critical | js/bg.js (line 23750) | Each time a tab loads (contentInjected event), the extension records the full URL with a timestamp. When the buffer fills to the remotely-configured bufferSize threshold, all accumulated URLs are batch-POSTed to the s… | |
| 9 | Code Injection | high | js/bg.js (line 10291) | The extension injects scripts into merchant website tabs to selectively delete entries from localStorage and sessionStorage. The items to delete are determined by remotely-fetched merchant configuration, enabling the … | |
| 10 | Code Injection | high | js/bg.js (line 10300) | The background script injects a function into arbitrary tabs and overwrites `localStorage` and `sessionStorage` with extension-supplied values. In the same cleanup routine it also iterates cookies for related domains … | |
| 11 | Data Exfiltration | high | js/bg.js (line 14921) | Extension VPN/proxy activity data is exfiltrated to analytics.besttoolbars.net, a third-party domain completely unrelated to the extension's stated netsave.su domain. The 'besttoolbars' domain is associated with known… | |
| 12 | Data Exfiltration | high | js/bg.js (line 23743) | The extension records visited page URLs and batches them for upload to its backend via `_saveHistory()`. This is broad browsing-history collection tied to page visits, and only a server-controlled blacklist limits wha… | |
| 13 | Network Interception | high | js/bg.js (line 21140) | The extension listens to all HTTP authentication challenges via onAuthRequired (for all URLs) to inject proxy credentials. While this is needed for the VPN/proxy feature, the 'asyncBlocking' mode and broad <all_urls> … | |
| 14 | Network Interception | high | js/bg.js (line 10113) | The extension installs a declarativeNetRequest rule that blocks all network requests containing affiliate tracking parameters (t_tid= and t_s=) across all resource types. This actively strips competitor affiliate trac… | |
| 15 | Phishing | high | js/bg.js (line 21511) | After installation, the extension trusts a server-supplied `installLink`, closes matching tabs, and opens that remote URL in a new active tab. That remote-controlled post-install navigation can be repurposed for unwan… | |
| 16 | Privilege Escalation | high | js/bg.js (line 24140) | The extension enumerates installed extensions and disables any whose IDs appear in `disableExtList`, a list populated from remote configuration. Silencing other extensions is a strong privilege-escalation and anti-com… | |
| 17 | Tracking | medium | js/bg.js (line 9742) | The extension periodically posts a persistent `extension_id` and version to its backend, and the surrounding helper adds OS, browser, and language metadata when analytics are enabled. This supports long-term device-le… | |
