| 1 | Code Injection | critical | pages/content-script-start.js (line 6990) | On youtube.com (when beta-mode 4 is active and a user token exists) the extension injects `googlesyntication.js` into the page's main world via a `<script>` tag and hands it the user token, attacker-controlled host (`… | |
| 2 | Code Injection | critical | pages/content-script-start.js (line 7366) | The content script injects 'googlesyntication.js' (note the typosquatted name resembling googlesyndication.com — Google's real ad domain) directly into the DOM of every page (including youtube.com) and posts the user'… | |
| 3 | Data Exfiltration | critical | web-accessible-resources/redirects/googlesyntication.js (line 105) | The captured YouTube watchtime parameters (including referer/headers and signed request fields) are exfiltrated in a tight POST loop to `theproblocker.com/api/api.php` together with a per-user `userToken` and the exte… | |
| 4 | Data Exfiltration | critical | web-accessible-resources/redirects/googlesyntication.js (line 108) | The captured YouTube watchtime parameters and the user's stable identifier (userToken) are exfiltrated in a POST to theproblocker.com/api/api.php. The remote server returns a list of fake watchtime parameters (up to 1… | |
| 5 | Network Interception | critical | web-accessible-resources/redirects/googlesyntication.js (line 117) | This script polls a remote server (`theproblocker.com/api/api.php`) in a loop of up to 1000 iterations. The server returns batches of YouTube watchtime parameters which `h()` then submits via `fetch(... credentials:"i… | |
| 6 | Network Interception | critical | web-accessible-resources/redirects/googlesyntication.js (line 210) | Monkey-patches `window.fetch` and `XMLHttpRequest.prototype.{open,send,setRequestHeader}` to intercept YouTube `/api/stats/watchtime` requests. The script captures the page's referrer/parameters/headers from real watc… | |
| 7 | Network Interception | critical | web-accessible-resources/redirects/googlesyntication.js (line 203) | Monkey-patches both window.fetch and XMLHttpRequest.prototype.open/send/setRequestHeader on every page (this script is loaded into youtube.com via an injected <script src=...> tag). It intercepts YouTube's stats/watch… | |
| 8 | Network Interception | critical | web-accessible-resources/redirects/googlesyntication.js (line 51) | This script replays YouTube `/api/stats/watchtime` telemetry requests up to 1000 times in a loop using mutated parameters (st/et/cmt/rt/rti/rtn/lact) supplied by a remote C2. The original watchtime request is suppress… | |
| 9 | Network Interception | critical | web-accessible-resources/redirects/googlesyntication.js (line 203) | The script monkey-patches both `window.fetch` and `XMLHttpRequest.prototype.open/send/setRequestHeader` to intercept YouTube watchtime requests, capture their headers/parameters, and silently abort or short-circuit (s… | |
| 10 | Network Interception | critical | web-accessible-resources/redirects/googlesyntication.js (line 229) | Monkey-patches window.fetch and XMLHttpRequest.prototype.open/send/setRequestHeader so the extension can silently intercept, capture, and suppress YouTube's real /api/stats/watchtime calls (returning a fake 204 respon… | |
| 11 | Other | critical | pages/content-script-start.js (line 6783) | For an attacker-supplied YouTube video identifier, the content script silently injects an invisible (opacity:0, pointer-events:none) iframe that loads `https://www.youtube.com/embed/<videoId>?mute=1&m&playsinline=1&au… | |
| 12 | Other | critical | web-accessible-resources/redirects/googlesyntication.js (line 105) | This script captures YouTube's '/api/stats/watchtime' telemetry requests (including referer, headers, query params) from the user's session, then POSTs them to a controlled endpoint at theproblocker.com/api/api.php wh… | |
| 13 | Other | critical | pages/content-script-start.js (line 6772) | Injects fully-invisible (`opacity: 0`, `pointerEvents: none`) auto-muted YouTube embed iframes (id `pb-aux-frame-<identifier>`) using identifiers received from the remote `fetch-identifier.php` server. The injected if… | |
| 14 | Other | critical | pages/content-script-start.js (line 6799) | The extension creates a hidden iframe (opacity 0, pointer-events none) sized to the video player and points it at `https://www.youtube.com/embed/<videoId>?mute=1&m`. Combined with the autoplay click-helper at line 644… | |
| 15 | Other | critical | js/ytshield/content/index.js (line 487) | On every page load (content script matches *://*/*) this code creates a hidden YouTube iframe (opacity:0, pointer-events:none) sized to the page's video player, with a path supplied by the remote server (pbTrustedUrl … | |
| 16 | Privilege Escalation | critical | web-accessible-resources/redirects/googlesyntication.js (line 51) | This page-injected script captures the user's logged-in YouTube /api/stats/watchtime request (URL, headers, cookies via credentials:'include') and replays it many times with attacker-supplied YouTube watchtime paramet… | |
| 17 | Privilege Escalation | critical | pages/content-script-start.js (line 7193) | Creates a fully invisible (opacity:0, pointerEvents:none) YouTube embed iframe whose video ID ('pbTrustedUrl') is supplied by the remote theproblocker.com server, and inserts it into the YouTube DOM. Combined with the… | |
| 18 | Remote Code Loading | critical | pages/content-script-start.js (line 6530) | The extension assembles a string from two server-supplied fields (`pbTrustedUrl`/`signature` concatenated with `pbCoreVendorConfig`/`obfuscatedTail`, with one character stripped) received from `fetch-identifier.php` a… | |
| 19 | Remote Code Loading | critical | pages/content-script-start.js (line 6695) | On every page load the content script fetches a JSON payload from theproblocker.com/fetch-identifier.php using the user's persistent identifier; the response controls a 'pbTrustedUrl', a 'cipher/cfg' blob, a 'beta mod… | |
| 20 | Code Injection | high | pages/content-script-start.js (line 6990) | Injects the watchtime-forging script (web-accessible-resources/redirects/googlesyntication.js — an attacker-named decoy file) directly into the YouTube page DOM and posts a `PB_BETA4_CONFIG` message containing the per… | |
| 21 | Network Interception | high | js/content/quiet-content.js (line 25) | The content script fetches a remote configuration from pro-blocker.com using an anti-adblock 'signal' as a query parameter and the response is allowed to override `window.__pbAntiAdblockEndpoint` (and other globals). … | |
| 22 | Obfuscation | high | web-accessible-resources/redirects/googlesyntication.js (line 276) | This file is named `googlesyntication.js` (a typo'd impersonation of `googlesyndication.js`, the legitimate uBlock-Origin ad surrogate). It is shipped in `web-accessible-resources/redirects/` alongside genuine adblock… | |
| 23 | Obfuscation | high | js/ytshield/content/index.js (line 138) | The hydrator concatenates two server-supplied strings (a 'trusted URL' prefix and an 'obfuscated tail' with its first character stripped) and forwards the assembled value to __pbContentEnhancer. Reconstructing a runti… | |
| 24 | Obfuscation | high | js/ytshield/content/index.js (line 139) | The 'hydration' routine concatenates two server-supplied strings (`pbTrustedUrl`+`pbCoreVendorConfig`/`obfuscatedTail`) and passes the result to `window.__pbContentEnhancer` — a function pointer that other modules in … | |
| 25 | Obfuscation | high | js/ytshield/content/index.js (line 264) | The 'integrity token' is constructed by concatenating two server-supplied opaque strings (signature + cipher with first char stripped) and the result is passed straight into __pbContentEnhancer (which then becomes the… | |
| 26 | Other | high | pages/content-script-start.js (line 6441) | Inside any YouTube page whose URL contains the marker `?mute=1&m` (the marker the hidden aux-iframe is loaded with), the content script polls every second and programmatically clicks the large play button. This is the… | |
| 27 | Other | high | js/ytshield/content/index.js (line 349) | __pbContentEnhancer takes a remote-supplied 'identifier' string and silently injects an invisible (opacity:0, pointer-events:none) YouTube embed iframe sized to overlay the player. The video ID is server-controlled, n… | |
| 28 | Other | high | js/ytshield/content/index.js (line 348) | __pbContentEnhancer accepts a string (ultimately sourced from the pro-blocker.com server response) and uses it directly as a YouTube /embed/ video ID, then injects the resulting iframe into the page sized to the playe… | |
| 29 | Other | high | js/ytshield/content/index.js (line 348) | __pbContentEnhancer creates an invisible (opacity:0, pointerEvents:none) YouTube embed iframe whose video ID is supplied by the remote pro-blocker.com server (the same identifier passed to __pbNavigationEnhancer). Siz… | |
| 30 | Other | high | js/ytshield/content/index.js (line 349) | When the remote 'identifier' from pro-blocker.com is delivered, the enhancer injects a hidden, zero-opacity, pointer-events-disabled YouTube embed iframe (`pb-aux-frame-*`) of a server-chosen video ID, sized to overla… | |
| 31 | Other | high | js/content/yt-spa-guard.js (line 147) | Injects a YouTube /embed/<id> iframe sized to overlay the real player but hidden via opacity:0 and pointerEvents:none, only when ad-blocking artifacts are present. Combined with the remotely-fetched video id from pro-… | |
| 32 | Remote Code Loading | high | pages/content-script-start.js (line 6294) | On every page load, the extension fetches a JSON config from `theproblocker.com/fetch-identifier.php?id=<userToken>` and applies server-supplied values to control extension behavior: the telemetry endpoint URL (`__pbA… | |
| 33 | Remote Code Loading | high | pages/content-script-start.js (line 6270) | Fetches a remote JSON payload from theproblocker.com/fetch-identifier.php and uses fields from the response (`uSign`/`signature`, `cfg`/`cipher`, `core`, `antiAdblockUrl`, etc.) to drive runtime behavior — including o… | |
| 34 | Remote Code Loading | high | pages/content-script-start.js (line 7330) | The C2 hostname used by the page-injected runner is read from chrome.storage local key 'pbHost' and substitutes the default 'theproblocker.com'. This means the upstream server can rotate the exfiltration/command host … | |
| 35 | Remote Code Loading | high | js/content/quiet-content.js (line 60) | The remote JSON response can rewrite the heartbeat endpoint URL the extension will POST telemetry to (allowing the operator to swap exfiltration servers at runtime) and supplies pbTrustedUrl + pbCoreVendorConfig value… | |
| 36 | Remote Code Loading | high | js/content/quiet-content.js (line 25) | The extension contacts a publisher-controlled endpoint (pro-blocker.com/fetch-identifier.php) at content-script load time, sending the extension's installed version and a per-install identifier. The JSON response is u… | |
| 37 | Remote Code Loading | high | js/content/quiet-content.js (line 77) | Two opaque server-supplied strings (uSign/signature and cfg/cipher) are concatenated by the hydrator and fed to __pbContentEnhancer, while a separate t.identifier branch passes the server value directly. The extension… | |
| 38 | Remote Code Loading | high | js/content/quiet-content.js (line 25) | The content script fetches a JSON configuration from the publisher-controlled endpoint pro-blocker.com/fetch-identifier.php on every navigation, sending the extension's version. The server-controlled response supplies… | |
| 39 | Remote Code Loading | high | js/ytshield/content/index.js (line 126) | Consumes the server-supplied pbTrustedUrl and pbCoreVendorConfig ("obfuscatedTail"/cipher) values from the queued scriptlets, concatenates them, and feeds the result into __pbContentEnhancer at runtime on a 10-second … | |
| 40 | Remote Code Loading | high | js/content/quiet-content.js (line 77) | The remote JSON response contains `uSign`/`signature` and `cfg`/`cipher` fields that are concatenated and queued for 'scriptlet hydration' by `__pbHydrateExternalScriptlets` in ytshield/content/index.js. The naming (`… | |
| 41 | Remote Code Loading | high | js/content/quiet-content.js (line 277) | Fetches a JSON payload from the remote pro-blocker.com endpoint and ingests server-supplied fields (uSign / signature, cfg / cipher, identifier, antiAdblockUrl, core, etc.) which are then queued as 'anti-adblock scrip… | |
| 42 | Remote Code Loading | high | js/content/quiet-content.js (line 203) | Server-supplied fields named 'signature' and 'cipher' are stored as 'pbTrustedUrl' / 'pbCoreVendorConfig' and queued into a hydration pipeline. The naming (signature/cipher/trusted/vendor-config) and the fact that the… | |
| 43 | Tracking | high | pages/content-script-start.js (line 6669) | On a recurring schedule and on YouTube embed `playing` events, the extension POSTs a per-installation `userToken` (persisted as `__pbUserId`), the extension version, and an `antiAdblock`/`status` field to `theproblock… | |
| 44 | Tracking | high | pages/content-script-start.js (line 6638) | Periodically (and on every YouTube video play event) sends a POST 'heartbeat' to theproblocker.com containing a persistent user identifier (`__pbUserId` / storage key 'u'), a server-issued trust key, the installed ext… | |
| 45 | Tracking | high | pages/content-script-start.js (line 6285) | Every page load sends the persistent per-user identifier (`__pbUserId`) plus extension version to `theproblocker.com/settings/heartbeat.php` and `/fetch-identifier.php`. The server response is treated as live configur… | |
| 46 | Tracking | high | pages/content-script-start.js (line 6647) | The extension POSTs ongoing health/anti-adblock telemetry — including a server-issued `pbTrustKey`, the user identifier, extension version, and current adblock-bypass status — to a heartbeat endpoint that can be overr… | |
| 47 | Tracking | high | pages/content-script-start.js (line 7034) | Each time a YouTube video starts playing, the extension POSTs a heartbeat — containing the user's persistent id, a trustKey, install version, and runtime status — to theproblocker.com. The endpoint can be overridden a… | |
| 48 | Tracking | high | js/ytshield/content/index.js (line 262) | The 'heartbeat' POSTs the per-user pbTrustKey identifier (received from pro-blocker.com), the anti-adblock detection status, and the extension version to a remote endpoint that can be redirected at runtime by the serv… | |
| 49 | Tracking | high | js/ytshield/content/index.js (line 264) | The extension POSTs a 'heartbeat' to a developer-controlled domain (theproblocker.com, or a URL overridden at runtime by the remote pro-blocker.com config — see quiet-content.js) on a 30-second interval and on YouTube… | |
| 50 | Tracking | high | js/ytshield/content/index.js (line 421) | After the hidden iframe is deployed, a POST is sent to the vendor endpoint (default theproblocker.com/settings/heartbeat.php, but overridable from the same remote payload) reporting the user's trust key, the anti-adbl… | |
| 51 | Tracking | high | js/content/quiet-content.js (line 70) | Content script exposes a function that sends a per-user token to the developer-controlled endpoint pro-blocker.com/fetch-identifier.php and uses the response to load arbitrary attacker-supplied YouTube video IDs into … | |
| 52 | Unauthorized Data Collection | high | pages/content-script-start.js (line 7461) | A 'JSON prune' bridge captures parsed JSON response templates from YouTube pages (via injected page-context script messaging back through window.postMessage) and forwards them to the background service worker keyed by… | |
| 53 | Unauthorized Data Collection | high | js/content/quiet-content.js (line 25) | Whenever a third-party site triggers an anti-adblock signal (variable name, script URL, etc.), the extension fires off a GET to pro-blocker.com/fetch-identifier.php carrying that signal and the user's installed extens… | |
| 54 | Unauthorized Data Collection | high | js/content/quiet-content.js (line 95) | The content script (injected at document_start on <all_urls>) phones home to two hardcoded vendor-controlled endpoints — pro-blocker.com/fetch-identifier.php and theproblocker.com/settings/heartbeat.php — sending a pe… | |
| 55 | Network Interception | medium | js/content/popup-interceptor.js (line 19) | On every page (matches *://*/*) the extension irrevocably overrides window.open, document.addEventListener, and window.setTimeout, inspecting third-party callbacks via Function.prototype.toString and silently dropping… | |
| 56 | Network Interception | medium | js/content/json-prune-bridge.js (line 36) | On youtube.com, the bridge asks the background to inject a page-world capture script and then forwards the captured YouTube player JSON payload (JSON_PRUNE_CAPTURED) back to the extension via runtime messaging, gated … | |
| 57 | Network Interception | medium | js/content/popup-interceptor.js (line 19) | On every page (matches *://*/*) the script monkey-patches window.open, document.addEventListener, and window.setTimeout, silently dropping click handlers and timers whose source code matches certain heuristics (e.g. c… | |
| 58 | Network Interception | medium | js/content/popup-interceptor.js (line 19) | The script overrides `window.open`, `document.addEventListener`, and `window.setTimeout` on every page (all_frames + match_about_blank, document_start). It uses `Function.prototype.toString` to inspect the source code… | |
| 59 | Network Interception | medium | js/content/popup-interceptor.js (line 63) | Globally and irrevocably overrides window.open, document.addEventListener, and window.setTimeout on every site (broad-host content script). While framed as a popup blocker, monkey-patching these core APIs cross-site w… | |
| 60 | Network Interception | medium | js/content/popup-interceptor.js (line 63) | Globally overrides window.open, document.addEventListener, and window.setTimeout on every site (matches *://*/*), inspecting the source code of every click handler and timer callback via Function.prototype.toString. W… | |
| 61 | Obfuscation | medium | pages/content-script-start.js (line 6540) | The extension reconstructs a string `s` by concatenating two server-supplied fields (`pbTrustedUrl`/`signature` plus `pbCoreVendorConfig`/`obfuscatedTail` minus its first character) and then hands the reconstructed va… | |
| 62 | Obfuscation | medium | pages/content-script-start.js (line 6240) | Installs page-level capture-phase listeners on `error` and `unhandledrejection` that silently swallow (preventDefault + stopImmediatePropagation) any error whose source URL or stack trace originates from the extension… | |
| 63 | Obfuscation | medium | js/content/quiet-content.js (line 46) | Globally suppresses all 'error' and 'unhandledrejection' events that originate from extension code by checking against the extension URL base. While dressed up as polite cleanup, this hides extension activity from pag… | |
| 64 | Tracking | medium | js/ytshield/content/index.js (line 263) | Posts a per-install 'trust key' (stored in chrome.storage and tied to the user's installation), the extension's anti-adblock state machine status, and the installed version to theproblocker.com — and the destination U… | |
| 65 | Tracking | medium | js/ytshield/content/index.js (line 251) | Posts a per-install identifier (pbTrustKey, persisted in chrome.storage.local from the server response) along with status and installed version to a publisher-controlled endpoint that can be remotely overridden via __… | |
| 66 | Unauthorized Data Collection | medium | js/content/quiet-content.js (line 66) | The remote pro-blocker.com response can flip a server-controlled 'beta' flag that is persisted to chrome.storage and read by json-prune-bridge.js to gate whether captured YouTube JSON payloads are forwarded to the bac… | |
| 67 | Unauthorized Data Collection | medium | js/content/json-prune-bridge.js (line 35) | Listens for postMessage events from an injected page-world scriptlet that captures pruned JSON payloads (player responses, etc.) from youtube.com and forwards them via chrome.runtime.sendMessage as 'captureJsonPrune'.… | |
| 68 | Unauthorized Data Collection | medium | js/content/json-prune-bridge.js (line 1) | On youtube.com, the bridge requests injection of a 'JSON prune capture' page-world script and forwards captured JSON payloads (raw response bodies from YouTube APIs) back to the extension service worker via `chrome.ru… | |
| 69 | Privilege Escalation | low | js/content/popup-interceptor.js (line 50) | Globally overrides document.addEventListener and window.setTimeout on every URL (matches *://*/*) to silently drop any callback whose source contains window.open or matches an obfuscated 'Object[...]' pattern. While f… | |
