| 1 | Remote Code Loading | critical | background.js (line 10874) | The background script dynamically loads a Google Tag Manager container (GTM-P39CV72) from a remote URL at runtime, injecting it into the extension's background page DOM. GTM containers are managed server-side and can … | |
| 2 | Network Interception | high | merge/merge.js (line 218) | The extension reads a list of URLs from `chrome.storage.local` under the key `pdfs` and issues `fetch()` requests to each with no origin validation or allowlist. Because the extension holds the `<all_urls>` permission… | |
| 3 | Privilege Escalation | high | popup.js (line 76) | When the popup opens, chrome.tabs.query({}) with no filter retrieves ALL open tabs, and chrome.tabs.executeScript is then called on every single tab indiscriminately — including banking, email, and other sensitive sit… | |
| 4 | Remote Code Loading | high | background.js (line 10874) | The background page dynamically constructs and injects a Google Tag Manager script (container GTM-P39CV72) at runtime by cloning a DOM node and appending it to the document body. GTM containers can load and execute ar… | |
| 5 | Tracking | high | background.js (line 10874) | The extension embeds Google Tag Manager (container GTM-P39CV72) into its background page to silently track all users without disclosure or consent. GTM containers can push additional analytics tags, conversion pixels,… | |
| 6 | Unauthorized Data Collection | high | popup.js (line 75) | The popup unconditionally queries every open browser tab (`chrome.tabs.query({})` with no filter) and injects and executes a dynamically-assembled code string into the DOM of every single tab. While the injected code … | |
| 7 | Unauthorized Data Collection | high | popup.js (line 84) | The extension collects the full URLs of all open browser tabs via `tabs.map((tab) => tab.url)` across every tab without restriction, exposing the user's complete browsing session to the extension's logic. Although the… | |
| 8 | Unauthorized Data Collection | high | popup.js (line 75) | The extension calls `chrome.tabs.query({})` with no filters to enumerate every single open tab across all windows, then immediately calls `chrome.tabs.executeScript` on each tab's ID to inject JavaScript code into the… | |
| 9 | Code Injection | medium | popup.js (line 77) | The `code` string passed to `chrome.tabs.executeScript` is assembled via string concatenation (`+ '"/pdf"' +`), a dynamic code construction anti-pattern. While the concatenated value here is a static string literal, t… | |
| 10 | Unauthorized Data Collection | medium | background.js (line 10874) | The extension calls chrome.i18n.getAcceptLanguages() to obtain the user's browser locale and transmits it as the `l` query parameter to googletagmanager.com on every background page load. This leaks browser fingerprin… | |
| 11 | Unauthorized Data Collection | medium | popup.js (line 88) | The extension first collects the full URL of every open tab via the unfiltered chrome.tabs.query({}) call, giving it visibility into the user's complete browsing session — all domains, paths, and query strings across … | |
| 12 | Unauthorized Data Collection | medium | merge/merge.js (line 221) | The merge page fetches arbitrary URLs from chrome.storage.local without any origin or content-type validation, then stores the response blobs keyed by URL in the popupFiles object. Since popup.js writes URLs to storag… | |
| 13 | Unauthorized Data Collection | medium | popup.js (line 88) | After injecting into all tabs, the extension also collects the full URL of every open tab via `tabs.map((tab)=>tab.url)`, providing a complete browsing-history snapshot at the moment the popup is opened. While filtere… | |
| 14 | Other | low | merge/merge.js (line 190) | The merged PDF is silently downloaded via `chrome.downloads.download()` with no filename specified and no user-facing save dialog, bypassing the browser's normal download confirmation flow. Additionally, `PDFDocument.… | |
| 15 | Other | low | merge/merge.js (line 221) | The merge page fetches the full binary content of PDF files from arbitrary HTTP/HTTPS URLs previously stored in `chrome.storage.local` by the popup. While these URLs originate from the user's own open tabs, the fetch … | |
