| 1 | Other | high | js/background.js (line 657) | The extension fetches remote configuration from `api1.extinsight.com` and uses it to decide which URLs to open on install/update. This gives a third-party service runtime control over user redirections and can be repu… | |
| 2 | Privilege Escalation | high | js/background.js (line 5482) | The extension registers a script ('js/proxy.js') to run in the 'MAIN' world on all URLs. This script has direct access to the page's DOM and JavaScript environment, which while used for style manipulation, represents … | |
| 3 | Remote Code Loading | high | background.js (line 2) | The background page dynamically creates a `<script>` element pointing at `https://www.google-analytics.com/analytics.js` and inserts it into the background document's DOM at runtime. This is a remote code loading patt… | |
| 4 | Remote Code Loading | high | background.js (line 2) | The background script dynamically injects the Google Analytics analytics.js library from an external URL (https://www.google-analytics.com/analytics.js) into the privileged extension background page and initializes a … | |
| 5 | Tracking | high | js/background.js (line 693) | Remote config also controls the uninstall URL and post-install/update tabs. That is a common growth/tracking pattern, but it is suspicious because the destinations are not fixed in the package and can be changed serve… | |
| 6 | Tracking | high | background.js (line 2) | The background page bootstraps Google Analytics (UA-206096968-1) and immediately fires a pageview hit every time the background page loads, sending telemetry to Google servers without explicit user consent. Critically… | |
| 7 | Tracking | high | background.js (line 2) | The background page dynamically loads the Google Analytics script from an external server at runtime and sends a pageview hit. The `ga("set","checkProtocolTask",null)` call deliberately bypasses GA's protocol validati… | |
| 8 | Unauthorized Data Collection | high | js/background.js (line 672) | The extension includes the ExtInsight tracking SDK which fetches remote configuration and URLs from 'api1.extinsight.com'. This data is used to track installations, updates, and uninstalls, and can potentially redirec… | |
| 9 | Code Injection | medium | js/background.js (line 5473) | The extension persistently injects a script into the page's MAIN world on every site and every frame at `document_start`. This is a very powerful pattern because MAIN-world code can interfere with native page APIs bef… | |
| 10 | Code Injection | medium | js/proxy.js (line 112) | This MAIN-world script monkeypatches core DOM and CSS APIs (`CSSStyleSheet`, `Document.styleSheets`, and sometimes `Element`/`Node` accessors). That is an invasive code-injection technique; while it can support dark-m… | |
| 11 | Code Injection | medium | background.js (line 1) | On installation, the background page queries ALL open browser tabs and injects `content.js` into each one using `chrome.tabs.executeScript`. This means the dark-mode content script is immediately injected into every p… | |
| 12 | Other | medium | manifest.json (line 1) | The manifest deliberately relaxes the default extension Content Security Policy to whitelist `https://www.google-analytics.com` as an allowed script source. The default MV2 CSP disallows all external script loading; o… | |
| 13 | Privilege Escalation | medium | background.js (line 1) | On installation, the extension enumerates every currently open tab and programmatically injects content.js into all of them via chrome.tabs.executeScript — including potentially sensitive pages such as banking portals… | |
| 14 | Remote Code Loading | medium | background.js (line 2) | The background script dynamically injects an external JavaScript file (`analytics.js`) from `https://www.google-analytics.com` at runtime by creating a `<script>` element and inserting it into the DOM. The manifest's … | |
| 15 | Tracking | medium | js/background.js (line 40) | Persistent user tracking using Google Analytics with a generated 'cid' (client ID) stored in local storage. The extension tracks background page views and potentially other events without explicit disclosure. | |
| 16 | Tracking | medium | background.js (line 2) | Google Analytics (property UA-206096968-1) is initialized in the persistent background page and fires a pageview event on every browser session start, sending data to Google's servers without user knowledge or consent… | |
| 17 | Unauthorized Data Collection | medium | content.js (line 1) | The content script runs at `document_start` (before DOM parsing) on every URL (`<all_urls>`) including `match_about_blank: true` and `all_frames: true`, and extracts the full page hostname via `document.location.href`… | |
| 18 | Unauthorized Data Collection | medium | manifest.json (line 1) | The content script is configured to run at `document_start` (before any page content loads) on `<all_urls>` including `http://`, `https://`, and `file:///` schemes, in all iframes (`all_frames:true`), and even in `abo… | |
| 19 | Other | low | background.js (line 1) | The variable `blacklist` is assigned without a `var`, `let`, or `const` declaration (`blacklist=e.blacklist`), creating an implicit global variable. In strict mode this would throw, but in the background page's non-st… | |
| 20 | Unauthorized Data Collection | low | content.js (line 1) | The content script reads document.location.href on every page load and matches it against a hard-coded list of ~30 major websites (Google, Gmail, YouTube, Facebook, Twitter, Amazon, etc.) to select a CSS stylesheet. W… | |
