| 1 | Data Exfiltration | critical | js/background.js (line 439) | When a redirect is triggered, the extension encodes the original URL (`rtu: encodeURIComponent(e.url)`) plus the unique user ID and partner ID 421 into the redirect destination URL (`v.re`). Additionally, a tracking l… | |
| 2 | Network Interception | critical | js/background.js (line 403) | The `q` function is registered as a `webRequestBlocking` listener and intercepts all main-frame HTTP/HTTPS navigations. It redirects users to remotely-configured affiliate/tracking URLs (stored in `v.a`) with tracking… | |
| 3 | Network Interception | critical | js/background.js (line 532) | This code activates a Chrome API method selected entirely by server-provided data stored in `hi.value.w`, `hi.value.r`, and `hi.value.a`. In practice it lets the remote backend decide which `chrome.webRequest` hook to… | |
| 4 | Network Interception | critical | js/background.js (line 403) | This is the core redirect/interception routine for top-level navigations. It rewrites requests to attacker-controlled destinations, appends a persistent `uid`, and later includes the original URL as `rtu`, which is bo… | |
| 5 | Remote Code Loading | critical | js/background.js (line 531) | The `L.task()` function dynamically registers `q` (the redirect/hijack handler) as a `chrome.webRequest` blocking listener using property names received from the remote server (`e.hi.value.w`, `.r`, `.a` decode to `we… | |
| 6 | Remote Code Loading | critical | js/background.js (line 577) | The `sethistory` handler receives a base64-obfuscated payload from `tm.betcon.cn`, decodes it (`decodeURL` = reverse-base64), parses it as JSON, stores it as the redirect rules map `T`, and then calls `L.task()` to re… | |
| 7 | Code Injection | high | js/content.js (line 82) | The content script can inject a remote iframe into arbitrary visited pages using server-supplied selectors, styles, element IDs, and source URLs. It also passes the full current page URL to that remote endpoint, which… | |
| 8 | Data Exfiltration | high | js/content.js (line 82) | The `showhis()` content script function injects a hidden iframe into web pages on sites that match the remotely-fetched configuration. The iframe `src` includes `?u=<current_page_URL>` — exfiltrating the user's curren… | |
| 9 | Network Interception | high | js/background.js (line 675) | The extension uses `webRequestBlocking` to intercept all requests to `http://xz.xtione.com/*` and zeroes out any `Cookie` header before the request is sent. This strips the user's authentication cookies on requests to… | |
| 10 | Obfuscation | high | js/background.js (line 153) | The `w()` function is a custom obfuscation routine that splits a string, reverses each half, recombines, pads to valid base64 length, then decodes with `atob()`. It is used to decode server-fetched payloads (e.g., the… | |
| 11 | Privilege Escalation | high | js/content.js (line 181) | Any page script can send a `window.postMessage` with `from: "page"` and have it forwarded into the extension runtime, then receive the response back. This creates an unsafe bridge from untrusted web pages into privile… | |
| 12 | Tracking | high | js/background.js (line 186) | The `x.log()` utility sends data to `http://tm.betcon.cn/log.json` via a pixel beacon (`new Image().src`). It transmits the user's unique ID (`uid`), browser name, extension version, partner ID, event type codes, time… | |
| 13 | Tracking | high | js/background.js (line 61) | The extension generates a 32-character hex UUID (`o()`) and persists it in both `localStorage` (key `gid`) and `chrome.storage.local`. This UUID (`R`) is included in every tracking beacon and redirect URL sent to `tm.… | |
| 14 | Code Injection | medium | manifest.json (line 21) | The extension declares `'unsafe-eval'` in its Content Security Policy, which permits dynamic code execution via `eval()`, `new Function()`, and similar constructs. Combined with the remote C2 configuration channel alr… | |
| 15 | Obfuscation | medium | js/background.js (line 643) | The extension fetches a remotely hosted payload over plain HTTP and immediately decodes it with a custom `w()` routine before parsing it as JSON. That obfuscation hides the real server-delivered rules from static revi… | |
| 16 | Tracking | medium | js/background.js (line 186) | This sends telemetry to `tm.betcon.cn/log.json` using a tracking pixel. Elsewhere the extension generates and persists a unique `gid`/`uid`, and this logger is called with browsing URLs and extension metadata, enablin… | |
