| 1 | Data Exfiltration | critical | js/background.js (line 1) | The extension encodes user activity data (extension ID, version, action type, unique user ID, and timestamp) in base64 and sends it to a remote server via fetch. The server response can include a URL that is then autoโฆ | |
| 2 | Data Exfiltration | critical | js/background.js (line 1) | The processQueue method sends base64-encoded JSON (via btoa) containing the extension ID, version, action type, persistent user UID, and timestamp to a remote server. Critically, it then processes the server's JSON reโฆ | |
| 3 | Data Exfiltration | critical | ext-tracker.js (line 1) | The service worker sends a persistent user UID, extension ID, version, and timestamp (base64-encoded) to a third-party server over plain HTTP on every install/update event. Critically, if the server response contains โฆ | |
| 4 | Phishing | critical | js/background.js (line 1) | The server response from the action tracking endpoint can include a URL that is immediately opened in a new tab without any validation or user consent. This allows the remote server operator to open arbitrary URLs in โฆ | |
| 5 | Phishing | critical | js/background.js (line 1) | The processQueue method sends install/update action events with a persistent UID to a remote server, then opens a new browser tab to any URL the server returns in the response. This allows the remote server to silentlโฆ | |
| 6 | Phishing | critical | js/background.js (line 1) | The extension unconditionally opens a new browser tab to any URL returned by the remote server at darktmode.net/api/action. This is a remote command-and-control vector allowing the server operator to redirect users toโฆ | |
| 7 | Remote Code Loading | critical | js/background.js (line 1) | The extension posts telemetry data to a remote config endpoint and merges the entire server response into its local config object without any field validation. The config update interval is controlled by the server viโฆ | |
| 8 | Remote Code Loading | critical | js/background.js (line 1) | The updateConfig method periodically POSTs the extension ID, version, timestamp, and UID to a remote server and merges the entire server response directly into the local config object without any validation or allowliโฆ | |
| 9 | Remote Code Loading | critical | js/background.js (line 1) | The updateConfig method posts device fingerprint data (extension ID, version, timestamp, UID) to a remote config endpoint and stores whatever arbitrary JSON the server returns directly into the extension's local confiโฆ | |
| 10 | Remote Code Loading | critical | ext-tracker.js (line 18) | The extension fetches a response from the remote tracking server and, if the response contains a URL field, automatically creates a new browser tab navigating to that URL. This is a remote-controlled tab opening mechaโฆ | |
| 11 | Unauthorized Data Collection | critical | ext-tracker.js (line 3) | The extension sends a unique user identifier (uid), extension ID, version, and user action events (install/update) to an external server at http://darkmode-app.com/api/action/ encoded with base64. The server response โฆ | |
| 12 | Code Injection | high | js/popup.js (line 1) | The popup injects arbitrary JavaScript code strings directly into all frames of the active tab via chrome.tabs.executeScript with the code property rather than a sandboxed file. This pattern allows dynamic code executโฆ | |
| 13 | Code Injection | high | js/popup.js (line 1) | The extension uses chrome.tabs.executeScript with inline code strings (dynamic code injection) across all frames of any active tab. Injecting arbitrary JavaScript strings into all frames bypasses CSP and can be leveraโฆ | |
| 14 | Other | high | ext-tracker.js (line 3) | All telemetry and command-and-control traffic is sent over plain HTTP rather than HTTPS. For an extension with 4 million users, this means user identifiers and any server-issued redirect URLs are transmitted in cleartโฆ | |
| 15 | Phishing | high | js/background.js (line 8) | The extension generates a persistent per-user UUID and transmits it with install/update lifecycle events, version, extension ID, and timestamp to a remote server. The same response handler then opens any URL returned โฆ | |
| 16 | Phishing | high | js/background.js (line 1) | The extension generates a persistent UID, sends install/update lifecycle telemetry to a remote server, and then opens any URL the server returns in a new tab. That remote-controlled tab launch is adware-like behavior โฆ | |
| 17 | Privilege Escalation | high | js/popup.js (line 1) | The extension uses chrome.tabs.executeScript with inline code strings to inject JavaScript into all frames of every active tab (allFrames: true). This broad dynamic script injection into arbitrary web pages gives the โฆ | |
| 18 | Remote Code Loading | high | js/background.js (line 21) | The background script opens arbitrary URLs provided by a remote server in new tabs. This behavior is characteristic of adware and allows the remote operator to redirect users to malicious or unwanted websites. | |
| 19 | Tracking | high | js/background.js (line 8) | The extension exfiltrates a unique user ID (UID) and extension metadata to a remote server (darktmode.net). The data is Base64 encoded to obfuscate the tracking activity from network inspection. | |
| 20 | Tracking | high | js/background.js (line 1) | The extension establishes connections to an external domain (darktmode.net) for action tracking, uninstall reporting, and config fetching. A unique user identifier (UID) is generated and persisted in local storage, thโฆ | |
| 21 | Tracking | high | js/background.js (line 1) | The extension establishes a unique user identifier (UID) stored in chrome.storage.local and sends it to a remote server at darktmode.net on every install/update event. The extension ID, version, and UID are base64-encโฆ | |
| 22 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID stored in chrome.storage.local that survives browser restarts. This UID is transmitted with every action event and config request to the remote darktmode.net server, enabling โฆ | |
| 23 | Tracking | high | ext-tracker.js (line 43) | The extension generates and persistently stores a unique user identifier (UID) in local storage, creating a permanent tracking ID that survives browser sessions. This UID is transmitted to the remote tracking server wโฆ | |
| 24 | Tracking | high | ext-tracker.js (line 43) | The extension generates a persistent unique identifier (UID) per browser profile and stores it in `chrome.storage.local`, then transmits it on every install/update event. This creates a durable cross-site tracking ideโฆ | |
| 25 | Unauthorized Data Collection | high | js/background.js (line 58) | The extension periodically sends state information to a remote server and receives configuration updates. This establishes a persistent remote control channel that can be used to modify the extension's behavior at anyโฆ | |
| 26 | Unauthorized Data Collection | high | js/background.js (line 1) | A persistent unique identifier is silently generated per user and stored in chrome.storage.local. This UID is sent to the remote server on every action, enabling long-term cross-site tracking of individual users withoโฆ | |
| 27 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension generates and persistently stores a unique identifier (UID) in chrome.storage.local on first run, and reuses it across all subsequent sessions and network requests. This UID is never exposed to the user โฆ | |
| 28 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension initializes an ExtStatTracker class that communicates with a remote server at darktmode.net via three hardcoded endpoints: action, config, and uninstall. It assigns a persistent unique identifier (UID) tโฆ | |
| 29 | Code Injection | medium | js/popup.js (line 1) | The extension injects JavaScript directly into the active tab using `chrome.tabs.executeScript` with inline `code` strings and `allFrames: true`. In this version the payload only modifies page styling, but this is stiโฆ | |
| 30 | Code Injection | medium | js/popup.js (line 1) | Multiple chrome.tabs.executeScript calls inject inline code strings into all frames of every visited page to manipulate DOM styles. While current payloads appear cosmetic, this pattern of repeatedly injecting inline cโฆ | |
| 31 | Data Exfiltration | medium | js/background.js (line 1) | On uninstall, the extension navigates the browser to a URL containing the persistent UID, extension ID, version, and timestamp โ exfiltrating user identity data to the remote server at uninstall time. While uninstall โฆ | |
| 32 | Other | medium | js/background.js (line 1) | The extension periodically pulls arbitrary configuration from a remote endpoint and persists all returned keys into local storage. Even though this sample does not directly execute returned code, server-driven behavioโฆ | |
| 33 | Phishing | medium | js/overlay.js (line 1) | A full-viewport overlay div with an extremely high z-index (999999999999) is injected into all page frames via allFrames: true. Although pointer-events is currently set to none, this infrastructure for a full-screen oโฆ | |
| 34 | Tracking | medium | js/background.js (line 28) | This code creates and persists a unique identifier, then embeds it into the uninstall URL and lifecycle reporting flow. That allows the developer to track individual users across install and uninstall events even thouโฆ | |
| 35 | Tracking | medium | js/background.js (line 1) | This code creates a unique identifier, stores it locally, sends it to remote endpoints, and embeds the same identifier into the uninstall URL. That is a classic extension telemetry pattern that enables persistent userโฆ | |
| 36 | Tracking | medium | popup.html (line 6) | The popup loads a stylesheet at runtime from an external Google Fonts CDN URL. This leaks the user's IP address and browser fingerprint to Google on every popup open, constituting cross-context tracking. A compromisedโฆ | |
| 37 | Tracking | medium | js/popup.js (line 1) | A URL template literal appends '{chrome.runtime.id}' as a plain string (missing the $ prefix for interpolation), revealing an intent to pass the extension runtime ID to an external URL for extension fingerprinting andโฆ | |
| 38 | Tracking | medium | js/background.js (line 1) | The extension registers an uninstall URL containing the user's persistent UID, extension ID, and timestamp encoded in base64. When the user uninstalls the extension, this URL is automatically opened, notifying the remโฆ | |
| 39 | Tracking | medium | popup.html (line 6) | The popup loads a stylesheet from Google Fonts every time the extension popup is opened, causing a network request to a third-party domain. This allows Google to observe popup-open events and correlates with the persiโฆ | |
| 40 | Tracking | medium | ext-tracker.js (line 25) | The extension registers an uninstall tracking URL that reports when a user removes the extension, including their persistent UID, extension ID, version, and timestamp encoded in base64. This allows the operator to traโฆ | |
| 41 | Tracking | medium | ext-tracker.js (line 64) | Upon installation, the extension opens a tab to a hardcoded external URL on a plain HTTP (non-HTTPS) domain. This page could serve tracking content, display ads, or act as a phishing/landing page. Using plain HTTP ratโฆ | |
| 42 | Tracking | medium | popup.html (line 7) | The popup loads a Google Fonts stylesheet from an external origin (fonts.googleapis.com) at runtime, which constitutes remote resource loading that can be used for tracking โ the Google Fonts CDN logs IP addresses andโฆ | |
| 43 | Tracking | medium | ext-tracker.js (line 25) | On every startup the extension pre-encodes the user's persistent UID, extension ID, version, and a timestamp into a base64 payload and registers it as the uninstall URL. While `setUninstallURL` is a legitimate API, thโฆ | |
| 44 | Unauthorized Data Collection | medium | ext-tracker.js (line 64) | On first install the extension unconditionally opens a navigation to `http://darkmode-app.com/install/` โ an unencrypted third-party page โ without any user consent. Combined with the UID already stored at this point,โฆ | |
| 45 | Other | low | js/check.js (line 7) | The content script attaches a 'mousemove' event listener to every page that triggers storage access and DOM manipulation on every movement. While primarily for color inversion, this pattern is extremely inefficient anโฆ | |
| 46 | Tracking | low | js/background.js (line 1) | The extension automatically opens a remote tracking URL on installation and sets an uninstallation URL to a third-party domain (darktmode.net). This is used for tracking extension lifecycle events and user activity wiโฆ | |
| 47 | Tracking | low | popup.html (line 10) | The popup loads a stylesheet from `fonts.googleapis.com` instead of packaging all resources locally. Remote resource loads from an extension UI can leak extension usage metadata such as IP address, user agent, and timโฆ | |
| 48 | Tracking | low | popup.html (line 1) | The popup loads a remote Google Fonts stylesheet, causing the extension UI to contact an external server whenever the popup opens. This is not necessary for core functionality and creates an avoidable external trackinโฆ | |
| 49 | Tracking | low | popup.html (line 6) | The popup page loads a stylesheet from the external Google Fonts CDN, causing a network request to a third-party domain every time the popup is opened. This leaks popup activation timing and user IP to Google, acting โฆ | |
| 50 | Tracking | low | popup.html (line 7) | The popup loads a Google Fonts stylesheet from an external origin on every popup open. This causes the user's IP address and browser fingerprint to be sent to Google's servers each time the popup is viewed, constitutiโฆ | |
