| 1 | Credential Theft | critical | script/bg.js (line 2) | When a user visits a merchant/shopping site, the extension injects a script into the page that deletes specific localStorage and sessionStorage keys, and then calls chrome.cookies.remove() to delete specific cookies —… | |
| 2 | Network Interception | critical | script/bg.js (line 2) | When a user navigates to a merchant website, the extension silently rewrites the active tab's URL to an affiliate redirect URL (sCashback.baseClick) controlled by the mallbery.com server. The query string includes the… | |
| 3 | Privilege Escalation | critical | script/bg.js (line 24143) | On startup, the extension enumerates installed extensions and disables any ID present in `disableExtList`. That list is populated from remote config earlier in the same file, so the operator can remotely turn off othe… | |
| 4 | Privilege Escalation | critical | script/bg.js (line 2) | On startup, the extension fetches a remote-controlled list of extension IDs (disableExtList, sourced from mallbery.com/api/configs/domains) and calls chrome.management.setEnabled(id, false) for any currently-enabled e… | |
| 5 | Network Interception | high | script/bg.js (line 2) | The extension installs a dynamic declarativeNetRequest rule that blocks all network requests containing the query parameters 't_tid=' or 't_s=' across every resource type including main frames, scripts, and XHR. These… | |
| 6 | Tracking | high | script/bg.js (line 2) | Every 12 hours the extension POSTs a telemetry beacon to https://analytics.savematik.com/ext-statistic/partners containing the extension ID, version, OS, browser type, and user language. This is sent to a third-party … | |
| 7 | Tracking | high | script/bg.js (line 2) | The extension pings https://pingapi.mallbery.com/api/ping every 15 minutes indefinitely. This heartbeat beacon allows the mallbery.com operator to know when each user's browser is active and to push updated configurat… | |
| 8 | Unauthorized Data Collection | high | script/bg.js (line 14807) | This code collects the IDs of all installed extensions and sends them to the extension's analytics pipeline. Installed-extension inventory is sensitive fingerprinting data and is not necessary for normal VPN/proxy fun… | |
| 9 | Unauthorized Data Collection | high | script/bg.js (line 23745) | The extension records visited page URLs with timestamps and batches them for upload via `_saveHistory`. Because the feature is enabled by remote config, the backend can turn browsing-history collection on or off witho… | |
| 10 | Unauthorized Data Collection | high | script/bg.js (line 2) | On extension install, chrome.management.getAll() enumerates every installed extension in the browser. All extension IDs are serialized to JSON and sent to the remote analytics server (analytics.savematik.com/ga) via a… | |
| 11 | Unauthorized Data Collection | high | script/bg.js (line 2) | VPN session activity data (caaAnalytics payload) is sent to https://analytics.besttoolbars.net — a third-party domain operated by BestToolbars, a known browser extension monetization platform. The extension's advertis… | |
| 12 | Phishing | medium | script/bg.js (line 21519) | After installation, the extension accepts a server-provided `installLink`, closes matching tabs, and opens the remote URL in a new active tab. That gives the backend direct control over user navigation and can be abus… | |
| 13 | Privilege Escalation | medium | manifest.json (line 26) | The manifest exposes all extension scripts and styles as web-accessible resources to all URLs (<all_urls>) with an empty extension_ids whitelist, meaning any webpage can load the extension's internal JS bundles. Addit… | |
| 14 | Tracking | medium | script/bg.js (line 9734) | This periodically posts a generated extension identifier and version to an external analytics endpoint. The helper `extendWithUserData` in the same module adds OS, browser, and language fields, creating a persistent t… | |
| 15 | Tracking | medium | script/bg.js (line 2) | The extension initiates purchase API calls to api.trademc.org using the user's unique install hash as the buyer identifier, and opens payment pages on pay.trademc.org. This integrates a third-party payment processor (… | |
