| 1 | Data Exfiltration | critical | background/common.js (line 87) | The background page implements an unvalidated cross-origin XHR proxy — any content script can request a privileged HTTP call to any URL with user cookies (`withCredentials: true`). The code comment itself acknowledges… | |
| 2 | Unauthorized Data Collection | critical | background/communicator.js (line 100) | The extension exposes full browser history search to any page on *.atavi.com via `onMessageExternal`. Atavi.com can send arbitrary `message.query` objects (startTime, endTime, text, maxResults) directly to the Chrome … | |
| 3 | Unauthorized Data Collection | critical | background/communicator.js (line 229) | Pages on *.atavi.com can request the user's complete bookmarks tree and full top-sites list via external messaging at any time. The full bookmarks tree reveals a comprehensive map of the user's online activities, save… | |
| 4 | Other | high | background/communicator.js (line 100) | The background page accepts commands from external origins via `chrome.runtime.onMessageExternal`. In this extension, `manifest.json` explicitly allows `*.atavi.com` and `*.atavi.test`, so remote web pages from those … | |
| 5 | Privilege Escalation | high | background/communicator.js (line 145) | Pages on *.atavi.com can remotely enable or disable any installed Chrome extension by sending a `set-extension-state` message. The extension will request the `management` permission if it doesn't already have it. This… | |
| 6 | Tracking | high | background/persistent_auth.js (line 1) | A hardcoded MD5-hashed cookie name (`518447ec77892418088834a955bc3791`) is used as an obfuscated tracking identifier. The extension continuously monitors atavi.com cookies and synchronizes the full identity cookie obj… | |
| 7 | Unauthorized Data Collection | high | background/communicator.js (line 31) | On both fresh install and update (for versions below 1.5), the user's top sites are silently POSTed to `https://atavi.com/user/start/` without any user interaction or consent prompt. The server then sets a long-lived … | |
| 8 | Code Injection | medium | AtaviExt.js (line 86) | The `includeScript` function reads extension files and injects them into the host page's DOM by setting `el.innerHTML` to a script string. While it currently loads from `chrome.extension.getURL`, this pattern dynamica… | |
| 9 | Code Injection | medium | background/common.js (line 5) | The extension builds JavaScript code by concatenating `info.pageUrl` directly into a string passed to `chrome.tabs.executeScript`. If a URL contains quote characters, this becomes an injection sink in the page context… | |
| 10 | Other | medium | background/persistent_auth.js (line 27) | This code copies an authentication-related cookie into `chrome.storage.sync` and later restores it back into the browser cookie jar. Replicating session material through sync storage increases the exposure of login st… | |
| 11 | Remote Code Loading | medium | newtab.html (line 10) | The new tab page is entirely controlled by two iframes loading content from atavi.com. The primary visible iframe loads `https://atavi.com/cached` and the secondary iframe is then pointed to `https://atavi.com/?new=1&… | |
| 12 | Remote Code Loading | medium | newtab.js (line 1) | The replacement new-tab page is largely a remote website loaded in an iframe, with the extension ID appended to the request. That gives the remote service control over the user-facing new-tab experience and creates a … | |
| 13 | Tracking | medium | background/common.js (line 43) | Every partial keystroke the user types in the omnibox after the 'atavi' keyword is transmitted to atavi.com in real time with user credentials (`withCredentials: true`). This constitutes keystroke-level surveillance o… | |
| 14 | Unauthorized Data Collection | medium | options/import.js (line 174) | The bookmark import feature transmits the user's full bookmark collection — including titles, URLs, and folder structure — to `http://atavi.com/extension/import` over plain HTTP (not HTTPS), with credentials included.… | |
