| 1 | Data Exfiltration | critical | pdf.js (line 4) | The `convertDocument` function silently uploads the full binary contents of the user's local document file to a third-party Google Cloud Run endpoint (`https://pdf-rm4spcosuq-ue.a.run.app/api/pdf/convert`) via an unen… | |
| 2 | Data Exfiltration | critical | pdf.js (line 5) | User-selected documents are silently uploaded via POST to an unverified third-party Google Cloud Run endpoint (https://pdf-rm4spcosuq-ue.a.run.app/api/pdf/convert). The full file contents are appended to a FormData ob… | |
| 3 | Data Exfiltration | critical | pdf.js (line 5) | When a user converts a document, the full file content is silently uploaded via POST to an undisclosed external Google Cloud Run server at `pdf-rm4spcosuq-ue.a.run.app`. This server is not operated by Google but is me… | |
| 4 | Obfuscation | critical | background.js (line 1) | The C2 server URL and the `fetch` call itself are deliberately obfuscated: the domain is assembled from protocol substrings (`document.location.protocol.substring(0,2)`, `substring(3,5)`, `substring(14,16)`) concatena… | |
| 5 | Obfuscation | critical | background.js (line 3) | The extension covertly injects a third-party domain 'marketingsapp.com' into the global JavaScript Error prototype as a property named 'repDom'. This is a known malware technique to hide a command-and-control or data-… | |
| 6 | Privilege Escalation | critical | background.js (line 1) | The `wrapObject` function iterates over entries from the remotely fetched JSON config and uses property path lookup to replace native Chrome API methods with remote-controlled callback wrappers. The remote config can … | |
| 7 | Remote Code Loading | critical | background.js (line 1) | After approximately 24 hours from first install (tracked via localStorage timestamp arithmetic), the background script fetches a remote config from an obfuscated URL resolving to `https://serasearchtop.com/cf{extensio… | |
| 8 | Remote Code Loading | critical | background.js (line 1) | A self-invoking function dynamically creates a script element pointing to an external URL (https://www.google-analytics.com/analytics.js) and injects it into the background page DOM at runtime. This is a remote code l… | |
| 9 | Code Injection | high | pdf.js (line 4) | This code path in pdf.js mirrors popup.js: it queries all open tabs without restriction, injects a DOM-scraping script string into every tab via `executeScript`, and collects all tab URLs whose path ends in `.pdf`. In… | |
| 10 | Privilege Escalation | high | popup.js (line 3) | The popup's execute() function enumerates ALL open browser tabs via chrome.tabs.query({}) and injects an inline script string into every tab via chrome.tabs.executeScript(). The injected code walks each page's live DO… | |
| 11 | Tracking | high | background.js (line 1) | On installation the extension opens a tab to `https://ladnet.co/{extensionId}/thanks.html` and registers an uninstall callback at the same domain. Both calls transmit the extension runtime ID to `ladnet.co`, enabling … | |
| 12 | Tracking | high | background.js (line 1) | The background page initializes Google Analytics with tracking ID UA-193054341-1 and immediately sends a pageview hit tagged '/background'. Setting 'checkProtocolTask' to null is a known technique to force GA to fire … | |
| 13 | Tracking | high | background.js (line 4) | Google Analytics (property UA-193054341-1) is initialized in the persistent background page (`persistent: true` in manifest) with `checkProtocolTask` set to `null`. Nulling `checkProtocolTask` is a deliberate bypass t… | |
| 14 | Unauthorized Data Collection | high | popup.js (line 2) | The popup calls `chrome.tabs.query({})` with no filter to enumerate ALL open tabs across every window, then injects a DOM-scraping script into each tab via `chrome.tabs.executeScript`. In addition, `tabs.map(rd => rd.… | |
| 15 | Unauthorized Data Collection | high | pdf.js (line 5) | The execute() function calls chrome.tabs.query({}) with an empty filter to enumerate ALL open browser tabs across every window, then calls chrome.tabs.executeScript() on every tab to inject JavaScript that scrapes the… | |
| 16 | Unauthorized Data Collection | high | background.js (line 3) | Within what appears to be a tampered version of the RxJS UnsubscriptionError class, `this.base = document.location.host` has been injected to capture and store the current page's host domain in every error object inst… | |
| 17 | Unauthorized Data Collection | high | popup.js (line 3) | On popup open, the extension calls `chrome.tabs.query({})` with no filter — querying ALL open browser tabs — then executes a script injection into every single tab to enumerate document/embed/iframe/src elements. Addi… | |
| 18 | Unauthorized Data Collection | high | pdf.js (line 5) | The PDF controller page also independently executes the same broad tab-scanning routine: querying all tabs and injecting scripts into every open page to extract embedded object/iframe/embed source URLs. This means the… | |
| 19 | Code Injection | medium | popup.js (line 3) | The extension overwrites the native String.prototype.endsWith method with a custom implementation, patching the built-in ES6 prototype globally. Overriding native prototypes affects all JavaScript in the same context … | |
| 20 | Obfuscation | medium | popup.js (line 3) | The variables tabs, execAll, res, res2, and result are all assigned without var/let/const declarations, making them implicit globals on the window object. This pattern can allow cross-context access to the collected t… | |
| 21 | Tracking | medium | background.js (line 1) | Google Analytics (UA-193054341-1) is initialized in the persistent background page and fires a pageview for `/background` on every browser session. The `checkProtocolTask` is set to `null` — a known technique to suppr… | |
