NFT Tab

Values from the external NFTPort API response (`thumbnail_url`, `description`, `name`, `chain`) are concatenated directly into an HTML string and written to `innerHTML` with no sanitization or escaping. If the API endpoint is compromised or returns attacker-controlled data, this is a direct stored XSS vector executing arbitrary JavaScript in the extension's new-tab page context, which has broad host permissions over all sites.

var imgurl = item['metadata']['thumbnail_url'];var description = item['metadata']['description'];var name = item['name'];var chain = item['chain'];var contract_address = item['contract_address'];var html = '<div class="col-md-3"><div class="box"><div class="box__img"><img src="' + imgurl +  '" alt=""></div><div class="box__text"><h4>' + name + '</h4><p class="des">' + description +  '</p><span class="chain">' + chain + '</span></div></div>';document.getElementById("Trending")  .innerHTML += html;

The extension replaces every new tab and hard-wires the search form to `https://bing.com/search`. All search queries typed by the user are submitted to Bing rather than their default search engine, which is a classic new-tab hijacker pattern used to generate search-affiliate revenue. Users' search terms are silently routed to a third-party service without disclosure or consent.

<form class="searchform" action="https://bing.com/search" target="_parent" method="get">  <div class="input-group mb-3" style="width: 50%; margin: auto;">    <input type="text" name="q" class="form-control" required="required">

A private NFTPort API key (`88e17fba-72ba-48b4-aaa3-82d65daf2b88`) is hardcoded in plaintext and shipped inside the extension. Any user who installs the extension can extract and abuse this credential. This constitutes an exposed secret that enables unauthorized use of a third-party paid API under the developer's account.

var url =  "https://api.nftport.xyz/v0/contracts/top?page_size=50&page_number=1&period=24h&order_by=volume&chain=ethereum&chain=polygon&chain=ethereum";var xhr = new XMLHttpRequest();xhr.open("GET", url, true);xhr.setRequestHeader('Authorization', '88e17fba-72ba-48b4-aaa3-82d65daf2b88');xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8");

The extension loads a stylesheet from an external CDN (`cdnjs.cloudflare.com`) at runtime rather than bundling the asset locally. While this particular CDN is reputable, loading remote resources from a new-tab page that has `*://*/*` host permissions means the CDN operator (or anyone who compromises it) can inject content into every new-tab page opened by the user.

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">

On every fresh install the extension silently opens `https://2050.one/nfttabthanks` in a new tab. This notifies the operator's server of each new installation (install-count tracking / affiliate conversion signal) without any user-visible disclosure. The URL also exposes user IP and browser fingerprint to the `2050.one` domain on install.

chrome.runtime.onInstalled.addListener(function(object) {  try {    if (object.reason === chrome.runtime.OnInstalledReason.INSTALL) {      const postInstallURLopen = 'https://2050.one/nfttabthanks'      chrome.tabs.create({        url: postInstallURLopen      })    }  } catch (e) {    console.log(e)  }})