Security Alert: Malware Risk Confirmed
This extension is flagged as malware and the latest analysis also reports severe findings. Remove it immediately if installed.Extension: Reader Mode
CRITICAL RISKStill available - exercise caution
Reader Mode
ID: llimhhconnjiflfimocjggfjdlmlhblm
Supported Languages
🇺🇸English
Extension Info & Metadata
Status
Active
Version
1.4.4
Size
5.35 MB
Rating
3.1/5
Reviews
185
Users
100,000
Type
Extension
Updated
Nov 29, 2025
Category
Accessibility
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Publisher Contextual Analysis
Trusted
- Author
- readermode.ioView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Total Extensions
3
Active
3
Obsolete
0
Listed
3
Unlisted
0
Total Users
102,917
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
An all-in-one, distraction-free reader with dyslexia support, accessibility features, bookmarking, highlighting, and research tools
Reader Mode is a feature-packed Chrome reading extension and web app that removes clutter, ads and distractions, while also includes advanced features such as dyslexia support, bookmarking, annotating, highlighting and text-to-speech. 📖 FEATURES • Distraction-free and ad-free "Reader Mode" • Web & PDF Highlighter • Share Reader Mode pages • Deletion of unwanted elements • Text-to-speech • Translation • Text Alignment • Custom theme • Custom CSS • Print page • Save page as PDF • Fullscreen mode • Auto-run ability • Auto-scroll • Save edited pages • Share To Twitter • Dyslexia Fonts • Dyslexia Ruler • Save and sync bookmarks all in one place • Sync to Evernote & Notion • and many more! To see all the features and learn more, check out https://readermode.io 📙 LEARN THE BASICS Learn how to use Reader Mode: https://help.readermode.io 🏷️ PRICING More information about pricing: https://readermode.io/pricing 🆘 SUPPORT Email: [email protected] Support form: https://airtable.com/shrJZYDwevtCoqck5
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical88
High102
Medium26
Low15
Versions scanned
Showing 35 of 40 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.0.9 | 4 |
| 2.0.8 | 3 |
| 2.0.7 | 3 |
| 2.0.6 | 3 |
| 2.0.5 | 4 |
| 2.0.3 | 3 |
| 2.0.2 | 4 |
| 2.0.1 | 5 |
| 1.5.8 | 7 |
| 1.5.7 | 9 |
| 1.5.6 | 5 |
| 1.5.5 | 8 |
| 1.5.4 | 7 |
| 1.5.3 | 7 |
| 1.5.2 | 6 |
| 1.5.0 | 10 |
| 1.4.9 | 9 |
| 1.4.8 | 10 |
| 1.4.7 | 8 |
| 1.4.6 | 7 |
| 1.4.5 | 7 |
| 1.4.4 | 7 |
| 1.4.3 | 8 |
| 1.4.2 | 8 |
| 1.4.1 | 9 |
| 1.3.9 | 8 |
| 1.3.8 | 8 |
| 1.3.7 | 6 |
| 1.3.5 | 7 |
| 1.3.4 | 6 |
| 1.3.3 | 6 |
| 1.3.2 | 7 |
| 1.3.0 | 7 |
| 1.2.9 | 7 |
| 1.2.8 | 8 |
Files with findings
20 distinct paths — top paths by unique finding count:
- javascripts/libs/safe-browsing.js90
- javascripts/libs/pageStatistics.js31
- javascripts/background.js20
- bg.js14
- javascripts/impacthero_background.js14
- automate.js10
- content-script.js10
- javascripts/src/redirectcheck.js7
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Code Injection | critical | javascripts/impacthero_background.js (line 95) | Uses the scripting permission with <all_urls> to inject the remotely-supplied `merchant` object and then `automate.js` into arbitrary pages the user visits whenever the hostname matches the downloaded merchant list. T… | |
| 2 | Code Injection | critical | javascripts/impacthero_background.js (line 99) | On every tab update the background worker cross-references the page hostname against the remotely fetched merchant list and, on a match, uses chrome.scripting.executeScript to inject a merchant payload and automate.js… | |
| 3 | Credential Theft | critical | javascripts/background.js (line 257) | Dynamically registers a webRequest.onBeforeSendHeaders listener (scoped to URLs supplied by remote config) that reads a specific outgoing request header by name (e.g. Authorization/Cookie), base64-encodes its value to… | |
| 4 | Credential Theft | critical | javascripts/content.js (line 53) | When the user visits the attacker-specified target domain, the content script scrapes session/user identifiers (uid, openapi_tk, cx context, gpta) by regex-matching a secret token out of page HTML, then hands them to … | |
| 5 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled "safe-browsing.js" library is not Google Safe Browsing; it is a third-party clickstream telemetry SDK configured to send FULL_NAVIGATION data to obfuscated domains id.sclpfybn.com and cs.sclpfybn.com under… | |
| 6 | Data Exfiltration | critical | javascripts/background.js (line 210) | POSTs a Bearer token (supplied by the content script from remote config) over plaintext HTTP to chromelogin.linewize.net — a domain squatting on the Linewize (school web-filter) brand. The endpoint is disguised as an … | |
| 7 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 909) | Exfiltration transport: JSON payloads (URL, page title, HTTP request headers, HTTP response, navigation sequence, tab/frame IDs, OS, browser, panelist IDs — built via BgPayloadBuilder) are lz-string-compressed to an o… | |
| 8 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The file is named 'safe-browsing.js' but is actually a clickstream/panelist data collection SDK. It configures a 'FULL_NAVIGATION' stream that exfiltrates navigation data to obfuscated domains id.sclpfybn.com and cs.s… | |
| 9 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 903) | POSTs compressed binary payloads containing captured URLs, tab/frame data, request/response headers, browser, OS, page titles, referrers, and panelist identifiers to '/secure/urls/checkSafety'. The 'checkSafety' namin… | |
| 10 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 909) | Collected navigation payloads (URL, timestamp, headers, tab context, OS/browser, panelist identifiers, referrer, title) are serialized, gzip-compressed to application/octet-stream, and POSTed to cs.sclpfybn.com. Compr… | |
| 11 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled 'safe-browsing' library is actually a commercial clickstream/panel-analytics SDK that streams the user's full navigation (mode: FULL_NAVIGATION) to the obfuscated third-party endpoints id.sclpfybn.com and … | |
| 12 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | Bundles a third-party `SafeBrowsing` SDK that actually operates in `FULL_NAVIGATION` mode against non-Google hosts `id.sclpfybn.com` and `cs.sclpfybn.com` (Panjiva-style clickstream panelist data brokerage). It assign… | |
| 13 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 177) | A second, separate telemetry pipeline registers a persistent per-user UUID and sends browsing data (URL, referrer, method, timestamps) to `stats.readermode.io/ajax` and `/process`, encrypting the payload with AES-GCM … | |
| 14 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 177) | Registers a chrome.webRequest.onCompleted listener on <all_urls> main_frame navigations and POSTs every URL/referrer/method tagged with a persistent UUID to https://stats.readermode.io, AES-GCM encrypted with a hardco… | |
| 15 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled 'safe-browsing' module is actually a third-party panelist/analytics SDK (sclpfybn.com, distributorId/partnerId 221) operating in FULL_NAVIGATION mode. It hooks chrome.webRequest.onSendHeaders/onHeadersRece… | |
| 16 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 177) | Captures every main_frame navigation via chrome.webRequest.onCompleted plus AJAX traffic on a hardcoded list of e-commerce/grocery sites (Amazon, Walmart, Tesco, Ocado, etc.), assigns a persistent UUID, AES-GCM-encryp… | |
| 17 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | Bundled third-party browsing-panel SDK (sclpfybn.com, a known Similarweb-associated data-collection domain). Runs in FULL_NAVIGATION mode, POSTing every URL visited to https://cs.sclpfybn.com/api/rest/v2/secure/urls/c… | |
| 18 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 177) | A full browsing-telemetry pipeline: every main_frame webRequest across <all_urls> is captured with a persistent UUID and POSTed to https://stats.readermode.io. Hard-coded API key ('Eiv5soh8oolid3Uu') and AES-GCM encry… | |
| 19 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The file marketed as 'safe-browsing' is in fact a bundled third-party panel-analytics / clickstream SDK (id.sclpfybn.com, cs.sclpfybn.com, distributorId/partnerId 221) running in FULL_NAVIGATION mode. It sends compres… | |
| 20 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 56) | Every completed main-frame request (target URL, referrer URL, HTTP method, timestamp, stable user UUID) is exfiltrated to the remote server stats.readermode.io/process. This is comprehensive browsing-history collectio… | |
| 21 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 1) | Registers a webRequest.onCompleted listener on <all_urls> main_frame and streams every URL the user visits to an external server (stats.readermode.io). The extension mints a persistent UUID identifier stored in chrome… | |
| 22 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | A file named 'safe-browsing.js' actually bootstraps a third-party panelist/analytics SDK that streams FULL_NAVIGATION data (URLs, tabs, frames, HTTP request headers, response data, browser/OS info, referrers) to exter… | |
| 23 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 177) | Registers chrome.webRequest.onCompleted across <all_urls> and uploads URL/referrer/timestamp/userId tuples for every main_frame navigation to 'https://stats.readermode.io', authenticated with a hard-coded api_key 'Eiv… | |
| 24 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 56) | For every main-frame network request on every site the user visits, this handler exfiltrates the target URL, the prior referrer URL (reconstructed from in-memory per-tab state), timestamps, HTTP method, and a stable p… | |
| 25 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | A bundled third-party 'Panelytics/clickstream' SDK is initialized in FULL_NAVIGATION mode and configured to send data to the sclpfybn.com infrastructure with panelistId/partnerId/distributorId — the canonical schema o… | |
| 26 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 56) | On every completed main-frame web request, the handler exfiltrates {userId (persistent UUID), referrerUrl, targetUrl, timestamp, method} to https://stats.readermode.io/process. Because refs[tabId] is chained across na… | |
| 27 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 8) | Registers a webRequest.onCompleted listener over <all_urls> and exfiltrates every main-frame navigation (timestamp, persistent per-user UUID, referrer URL, target URL, HTTP method) to https://stats.readermode.io/proce… | |
| 28 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | Bundles a third-party 'safe-browsing' SDK pointed at sclpfybn.com (distributorId/partnerId 221) operating in FULL_NAVIGATION mode — a known pattern used by commercial browsing-data monetization SDKs that resell every … | |
| 29 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 8) | Using the webRequest API on <all_urls> the extension intercepts every main_frame navigation and forwards the target URL, referrer URL, HTTP method, and a persistent per-user UUID to stats.readermode.io/process. This i… | |
| 30 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 1) | Registers a `chrome.webRequest.onCompleted` listener on `<all_urls>`/`main_frame` and exfiltrates every top-level navigation (target URL, referrer, method, persistent user UUID, timestamps) to `https://stats.readermod… | |
| 31 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | A bundled third-party "Panalytics"-style clickstream SDK configured in `FULL_NAVIGATION` mode, POSTing compressed navigation events to `cs.sclpfybn.com/api/rest/v2` and maintaining a persistent `panalyticsid` via cook… | |
| 32 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 1) | Installs a webRequest.onCompleted listener across <all_urls> for every main_frame navigation and POSTs the full URL, referrer, method, tab-scoped user UUID and timestamp to stats.readermode.io. This is a comprehensive… | |
| 33 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The module cosmetically named 'safe-browsing.js' is a third-party clickstream/panelist telemetry SDK (mode 'FULL_NAVIGATION') that ships every navigation to cs.sclpfybn.com — a randomized-label domain unrelated to 're… | |
| 34 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The extension bundles a third-party clickstream/panelist SDK (branded internally as 'safeBrowsing') that ships a unique panelist identifier plus hardcoded distributorId/partnerId=221 and pinstanceId=2 to two third-par… | |
| 35 | Data Exfiltration | critical | javascripts/libs/pageStatistics.js (line 1) | A second, independent exfiltration module is bundled in the extension. It encrypts browsing data with a hardcoded AES-GCM key and ships URL+referrer+timestamp+persisted UUID to an external 'recopiladora' (Spanish for … | |
| 36 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundle initializes a 'FULL_NAVIGATION' clickstream tracker that exfiltrates browsing data to two unrelated third-party endpoints (id.sclpfybn.com and cs.sclpfybn.com/api/rest/v2). Use of audience-panel terminology… | |
| 37 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled 'safe-browsing' library is actually a full-navigation clickstream SDK that sends user browsing data to the unrelated third-party domains id.sclpfybn.com and cs.sclpfybn.com with a partner/distributor ID (2… | |
| 38 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 903) | HttpClient compresses and POSTs the full URL-visit payloads (URL value, page title, referrer, tab context) as application/octet-stream to ${apiUrl}/secure/urls/checkSafety. The 'checkSafety' name is window-dressing; t… | |
| 39 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The extension embeds a commercial 'panel analytics' browsing-data-collection SDK whose backend is the undisclosed third-party domain sclpfybn.com. It boots in FULL_NAVIGATION mode, with a persistent panalyticsId ident… | |
| 40 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 909) | HttpClient.send serializes the assembled navigation payload (visited URL, captured headers, page title, tab context, panalyticsId) and POSTs it compressed (application/octet-stream) to `${apiUrl}/secure/urls/checkSafe… | |
| 41 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | Hard-coded configuration for a third-party 'panelist analytics' SDK that streams FULL_NAVIGATION data to sclpfybn.com with distributor/partner/panelist instance IDs. This is the canonical Similarweb/Panelist-style mon… | |
| 42 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled 'safe-browsing' library initializes a FULL_NAVIGATION telemetry stream pointing at two obfuscated third-party domains (id.sclpfybn.com, cs.sclpfybn.com) completely unrelated to the extension's stated Reade… | |
| 43 | Data Exfiltration | critical | javascripts/libs/safe-browsing.js (line 909) | The HttpClient POSTs compressed (application/octet-stream) payloads containing full URLs and navigation context to /secure/urls/checkSafety and /secure/urls/checkSafety/basic on the third-party endpoint. Compressing t… | |
| 44 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | Attaches webRequest and webNavigation listeners on every http/https URL across main and sub frames, capturing requestHeaders and responseHeaders for every page load, plus tab create/update/remove events. This is full-… | |
| 45 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1825) | Registers broad webRequest and webNavigation listeners matching {urls:['https://*/*','http://*/*'], types:['main_frame','sub_frame']} with requestHeaders/responseHeaders access. Every page the user visits — URL, reque… | |
| 46 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | The SDK installs webRequest and webNavigation listeners across every http(s) URL, capturing request/response headers, redirects, errors, navigation targets, and SPA history-state transitions for every page the user vi… | |
| 47 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1825) | The SDK registers listeners on webRequest (send/received headers, response started), webNavigation (beforeNavigate, completed, historyStateUpdated) and tabs (create/remove/replace/update) across all http(s) URLs, exfi… | |
| 48 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | Attaches listeners across http/https <all_urls> for every major webRequest stage (request/response headers, redirects, errors) plus every webNavigation and tab event. The captured URLs, headers and navigation graph ar… | |
| 49 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1825) | The panelist SDK registers extraInfoSpec listeners on webRequest.onSendHeaders / onHeadersReceived / onResponseStarted with ['requestHeaders'] / ['responseHeaders'], capturing raw HTTP request and response headers for… | |
| 50 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | The bundled SDK hooks every webRequest and webNavigation event (onSendHeaders/onHeadersReceived/onResponseStarted with requestHeaders+responseHeaders) on http(s)://*/* for main_frame and sub_frame, plus all tab lifecy… | |
| 51 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | Hooks nearly every chrome.webRequest / webNavigation / tabs event across both http://*/* and https://*/* for main_frame and sub_frame, capturing request headers, response headers, navigation history, redirects, and ta… | |
| 52 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1497) | The payload builder harvests full HTTP request and response metadata for every navigation: URL, request method, request headers, response headers, status code, redirect URL, server IP, page title, referrer, OS/browser… | |
| 53 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1825) | Hooks every webRequest (sent headers, received headers, response started) and every webNavigation event (before navigate, completed, history state updated, new target) for https://*/* and http://*/*. This captures req… | |
| 54 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | The bundled Stream SDK hooks nearly every browsing-surface API (webRequest send/receive headers/response/redirect/error, webNavigation before/complete/history-state/cross-tab, tabs create/update/remove/replace) across… | |
| 55 | Network Interception | critical | javascripts/src/redirectcheck.js (line 1) | Content script registered at document_start on <all_urls> performs an unvalidated open redirect: any page URL containing a `partnerurl=` query parameter causes `location.href` to be overwritten with the attacker-suppl… | |
| 56 | Network Interception | critical | javascripts/src/automate.js (line 31) | Injected into any merchant page hit, this script silently opens a background tab to `impacthero.co/?partnerurl=<merchant affiliate link>` — the partner URL that `redirectcheck.js` then follows and auto-closes. This is… | |
| 57 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | The bundled library attaches listeners to essentially every browser navigation and HTTP request event across http://*/* and https://*/* (main_frame and sub_frame), including request headers, response headers, redirect… | |
| 58 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | The tracker registers webRequest hooks (onSendHeaders, onHeadersReceived, onResponseStarted, onErrorOccurred, onBeforeRedirect) for every http(s) URL on every frame, capturing request and response headers. It also sub… | |
| 59 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1825) | Broad webRequest/webNavigation/tabs listeners over https://*/* and http://*/* capture every navigation event, request/response headers, tab creation/update events for all sites the user visits. These events feed the B… | |
| 60 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1815) | At service-worker startup the SDK attaches listeners on webRequest.onSendHeaders / onHeadersReceived / onResponseStarted and every webNavigation event across https://*/* and http://*/* with requestHeaders/responseHead… | |
| 61 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1825) | Registers webRequest+webNavigation listeners scoped to urls:['https://*/*','http://*/*'] and main_frame+sub_frame, capturing every request's URL, method, timestamp, request headers, response headers, status codes, red… | |
| 62 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 844) | The FgNavProcessor hooks every top-level navigation and bundles the URL, referrer, page title, tab linkage, OS, and any queued background sub-requests into a single payload stamped with the user's panelistId before sh… | |
| 63 | Network Interception | critical | javascripts/libs/safe-browsing.js (line 1184) | The library registers chrome.webRequest listeners across onSendHeaders, onHeadersReceived, onResponseStarted, and onBeforeRedirect for all frames and both main and sub-resource navigations. This intercepts every HTTP … | |
| 64 | Privilege Escalation | critical | automate.js (line 161) | When the user visits a matched merchant site, the extension silently opens a background tab to `impacthero.co` with an affiliate `partnerurl` derived from the downloaded merchant list. Combined with `redirectcheck.js`… | |
| 65 | Remote Code Loading | critical | javascripts/background.js (line 300) | At background-service-worker startup, the extension fetches an attacker-controlled configuration blob from readermodeext.info (a domain unrelated to the stated readermode.io product) and caches it in chrome.storage. T… | |
| 66 | Tracking | critical | javascripts/libs/safe-browsing.js (line 5139) | The so-called 'safe-browsing' module is actually a commercial panelist-analytics clickstream SDK reporting to the third-party domains id.sclpfybn.com and cs.sclpfybn.com under partnerId/distributorId 221. The mode 'FU… | |
| 67 | Tracking | critical | javascripts/libs/pageStatistics.js (line 56) | Each captured navigation is packaged with a stable userId (UUID), referrer URL (chained per-tab), target URL, method, and timestamps, then AES-GCM encrypted with a hardcoded symmetric key and POSTed to the backend. Th… | |
| 68 | Tracking | critical | javascripts/libs/pageStatistics.js (line 1) | Registers a chrome.webRequest.onCompleted listener on <all_urls> to capture every top-level navigation the user makes. Each hit is persisted to a stable UUID stored in chrome.storage.sync, which uniquely identifies th… | |
| 69 | Tracking | critical | javascripts/libs/safe-browsing.js (line 193) | The BgPayloadBuilder/FgPayloadBuilder payload objects tie every captured URL, page title, referrer, request headers, response headers, tab id, frame id, OS name/version, and browser name/version to a stable panelistId… | |
| 70 | Tracking | critical | javascripts/libs/safe-browsing.js (line 2484) | A 22-character 'panalyticsid' (panelistId) is generated and persisted across three independent channels — HTTP cache (/api/identity/cache with X-PANEL-USER-KEY header), server-set cookies (/api/identity/cookie), and l… | |
| 71 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 1497) | The navigation processor assembles a payload per visited page containing the full URL, request method, request headers, tabId chain, frame hierarchy, timestamp, page title, referrer, OS/browser fingerprint, and a pers… | |
| 72 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | Bundles a third-party clickstream SDK (id.sclpfybn.com / cs.sclpfybn.com) with FULL_NAVIGATION mode enabled, which uses the webRequest and webNavigation APIs (see lines 1825-1842) to capture every request header, resp… | |
| 73 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled 'safe-browsing' library is not Google Safe Browsing (which uses safebrowsing.googleapis.com). It is a third-party panelist/analytics SDK configured with distributorId/partnerId/panalyticsId and streams dat… | |
| 74 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | A bundled 'safe-browsing' library is actually a third-party clickstream/analytics SDK that ships a persistent panelist identifier (panalyticsId) and posts full-navigation data to the obscure domains id.sclpfybn.com an… | |
| 75 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | The bundled 'safe-browsing.js' is actually a third-party click-stream / panelist SDK (sclpfybn.com) that initialises in 'FULL_NAVIGATION' mode with a persistent panalyticsId, distributorId=221 and partnerId=221 and st… | |
| 76 | Unauthorized Data Collection | critical | javascripts/libs/pageStatistics.js (line 4) | After a click on one of the listed e-commerce sites (Amazon, Walmart, Tesco, Sainsbury's, etc.) the extension captures every subsequent webRequest (XHRs, pings, websockets, media, stylesheets, scripts — the full noLog… | |
| 77 | Unauthorized Data Collection | critical | javascripts/libs/pageStatistics.js (line 1) | Registers a chrome.webRequest.onCompleted listener across <all_urls> to intercept every main-frame HTTP request the user makes. A hardcoded API key and symmetric AES-GCM key are embedded, and a per-user UUID is genera… | |
| 78 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | Despite the file being named "safe-browsing.js", it bootstraps a third-party monetization/panelware SDK that contacts obscure domains id.sclpfybn.com and cs.sclpfybn.com in FULL_NAVIGATION mode with partner/distributo… | |
| 79 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 116) | The BgPayloadBuilder assembles exfiltration payloads tagged as 'INTERNAL_BROWSER_EXTENSION' containing per-navigation URL, HTTP request headers+method, HTTP response body, browser/OS fingerprint, tab/frame identity, a… | |
| 80 | Unauthorized Data Collection | critical | javascripts/libs/pageStatistics.js (line 3) | An AjaxLogCollect routine intercepts every completed web request on target e-commerce sites (Amazon, Walmart, Tesco, Sainsbury's, Loblaws, Ocado, ASDA, etc.) after a user click and ships full request details (includin… | |
| 81 | Unauthorized Data Collection | critical | javascripts/libs/pageStatistics.js (line 1) | Registers a webRequest.onCompleted listener for <all_urls> main_frame navigations and streams them to a remote server. The hard-coded api_key/encryptionKey and persistent UUID identify the user across the session, tur… | |
| 82 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | A second, independent tracking SDK ships with the extension, labeled "SafeBrowsing" but actually reporting to an unrelated third-party domain (sclpfybn.com) with distributorId/partnerId/pinstanceId fields typical of a… | |
| 83 | Unauthorized Data Collection | critical | javascripts/libs/pageStatistics.js (line 1) | Hooks chrome.webRequest.onCompleted on <all_urls> main_frame requests and exfiltrates every navigation (target URL, referrer URL, HTTP method, persistent UUID, timestamps) to https://stats.readermode.io/process. This … | |
| 84 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 5139) | Bundled third-party 'panelist' analytics SDK from sclpfybn.com (a known commercial browsing-data brokerage) configured in FULL_NAVIGATION mode with a partner/distributor ID. Despite being labeled SafeBrowsingAPI, it s… | |
| 85 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 193) | Payload builder assembles a per-navigation record containing the visited URL, page title, referrer, request/response headers, OS+browser fingerprint, tab/frame topology, and a stable panelistId tied to a partner/distr… | |
| 86 | Unauthorized Data Collection | critical | javascripts/app.js (line 2495) | The consent dialog (app.html line 1624: 'We do not collect any personal data') is deceptive. Both the Agree and Decline handlers dispatch the identical `safe-browsing-start` message, which the background worker forwar… | |
| 87 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 1502) | Builds a telemetry payload that joins each visited URL to a persistent user identifier (panalyticsId/pinstanceId/partnerId/distributorId), along with the full request method, request headers, response status/headers, … | |
| 88 | Unauthorized Data Collection | critical | javascripts/libs/safe-browsing.js (line 201) | The payload schema shows the SDK exfiltrates full URL, page title, referrer, request method & headers, response headers/status, tab IDs, frame IDs, OS, browser, and timestamps for every navigation — tagged with a stab… | |
| 89 | Code Injection | high | javascripts/impacthero_background.js (line 95) | For every tab navigation, the background script matches the tab's hostname against the remotely-fetched merchant list and silently injects automate.js plus a window.merchant payload into the page via chrome.scripting.… | |
| 90 | Code Injection | high | javascripts/impacthero_background.js (line 124) | Background script watches every tab update and, when the hostname matches a remote 'merchant list' fetched from storage.googleapis.com/impacthero-bucket, injects automate.js into the page. The merchant list (URLs + af… | |
| 91 | Data Exfiltration | high | javascripts/libs/safe-browsing.js (line 909) | The HTTP client POSTs compressed (application/octet-stream) navigation payloads to the remote endpoint /secure/urls/checkSafety and /secure/urls/checkSafety/basic on cs.sclpfybn.com. Binary compression of outgoing tra… | |
| 92 | Data Exfiltration | high | javascripts/content.js (line 90) | Attaches a DOM event listener (event name from remote config) that iterates elements matching a remote CSS selector, reads an arbitrary attribute off each, base64-encodes it together with a stored uid, and exfiltrates… | |
| 93 | Data Exfiltration | high | javascripts/libs/safe-browsing.js (line 909) | Payloads of intercepted navigations are POSTed (optionally gzip-compressed as application/octet-stream) to '${apiUrl}/secure/urls/checkSafety' and '/secure/urls/checkSafety/basic' on cs.sclpfybn.com. The compression+o… | |
| 94 | Data Exfiltration | high | javascripts/libs/safe-browsing.js (line 909) | Serializes and compresses the aggregated navigation/request payload (URL, headers, browser, OS, tab/frame ids, panelist identifiers) and POSTs it to cs.sclpfybn.com as application/octet-stream. The compression + octet… | |
| 95 | Network Interception | high | javascripts/libs/safe-browsing.js (line 751) | The library hooks chrome.webRequest events (onSendHeaders, onHeadersReceived, onResponseStarted, onBeforeRedirect, onErrorOccurred) across <all_urls> to capture full request/response headers, redirect chains, and serv… | |
| 96 | Network Interception | high | javascripts/libs/safe-browsing.js (line 1825) | Listens on every webRequest / webNavigation lifecycle hook across http://*/* and https://*/* with requestHeaders and responseHeaders access, forwarding the captured metadata into the clickstream pipeline. This is the … | |
| 97 | Network Interception | high | javascripts/libs/pageStatistics.js (line 4) | Uses the `webRequest` API against `<all_urls>` to intercept every network request category (xhr, subframe, websocket, etc.) on a curated list of high-value e-commerce retailers (Amazon/Walmart/Tesco/Asda/Sainsburys/Oc… | |
| 98 | Network Interception | high | javascripts/libs/safe-browsing.js (line 1825) | Installs listeners on the full chrome.webRequest lifecycle (onSendHeaders, onHeadersReceived, onResponseStarted, onErrorOccurred, onBeforeRedirect) with requestHeaders and responseHeaders extraInfoSpec so it can captu… | |
| 99 | Network Interception | high | javascripts/src/redirectcheck.js (line 14) | This content script runs at document_start on every URL and (a) unconditionally redirects any page whose URL contains a 'partnerurl=' query param to the value of that parameter — an open-redirect primitive usable by a… | |
| 100 | Network Interception | high | javascripts/src/automate.js (line 59) | When a user lands on a recognized merchant site, this injected script asks the background to silently open a hidden tab to impacthero.co with a partnerurl pointing at the merchant's affiliate link, hijacking the user'… | |
| 101 | Network Interception | high | javascripts/src/redirectcheck.js (line 14) | Content script injected at document_start on <all_urls> performs an open-redirect to whatever URL is supplied in the 'partnerurl' query parameter, then auto-closes the originating tab. Combined with automate.js, this … | |
| 102 | Obfuscation | high | javascripts/content.js (line 18) | All operational parameters — target domain, API URLs, header name to steal, CSS selectors, DOM event to listen for — are base64-encoded in remote config and decoded at runtime with atob(). This is deliberate obfuscati… | |
| 103 | Obfuscation | high | javascripts/background.js (line 1) | The service worker imports the clickstream SDK and wires a message-based toggle that the comment itself labels 'click stream consent', yet surfaces it to users as a 'safe browsing' feature. Flipping one flag simultane… | |
| 104 | Obfuscation | high | javascripts/background.js (line 1) | The service worker imports the clickstream SDK and wires its activation to a message labeled 'safe-browsing-agreement' while internally the developer's own comment admits it is the 'user's click stream consent'. The d… | |
| 105 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 117) | The exfiltrated browsing payload is AES-GCM encrypted with hardcoded keys before transmission, obscuring the contents from users, auditors and network monitoring tools. Encryption is bootstrapped automatically wheneve… | |
| 106 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 144) | Hardcoded API key ("Eiv5soh8oolid3Uu") and symmetric encryption key ("OoCh9oamNookooP8") are embedded directly in the extension, gating a clickstream uploader that is activated by a storage flag misleadingly named "sa… | |
| 107 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 117) | The payload is AES-GCM encrypted with a symmetric key hard-coded in the client before being uploaded. This conceals the browsing data in transit (also from network inspection tools) and is a textbook obfuscation patte… | |
| 108 | Obfuscation | high | javascripts/libs/safe-browsing.js (line 909) | The SDK's HTTP client compresses the navigation payload to application/octet-stream before POSTing to /secure/urls/checkSafety on cs.sclpfybn.com. Binary/compressed uploads under a 'safety check' endpoint name are an … | |
| 109 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 117) | The browsing data payload is AES-GCM encrypted client-side with a hard-coded symmetric key ("OoCh9oamNookooP8") and api_key ("Eiv5soh8oolid3Uu") before transmission. Encrypting exfiltrated telemetry with a key embedde… | |
| 110 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 144) | A hard-coded API key and AES-GCM encryption key are embedded in client code and used to authenticate and encrypt the browsing-history exfiltration stream to stats.readermode.io. Hard-coded credentials used client-side… | |
| 111 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 117) | Hard-coded API key ("Eiv5soh8oolid3Uu") and AES-GCM encryption key ("OoCh9oamNookooP8") are baked into every install. The encryption is purely obfuscation against on-device inspection — the same key is shipped to all … | |
| 112 | Obfuscation | high | javascripts/libs/pageStatistics.js (line 117) | The clickstream payload is AES-GCM encrypted client-side with a hardcoded 16-byte symmetric key bundled in the extension (`OoCh9oamNookooP8`) and a hardcoded API key (`Eiv5soh8oolid3Uu`) before being POSTed to readerm… | |
| 113 | Obfuscation | high | javascripts/libs/safe-browsing.js (line 1) | The 5,267-line third-party tracking module is shipped as a single minified/webpack-bundled file with single-letter identifiers and no source maps, hiding its true behaviour from casual review. Disguising clickstream c… | |
| 114 | Obfuscation | high | javascripts/libs/safe-browsing.js (line 909) | Exfiltration transport: serializes the harvested payload to JSON, then LZ-string compresses it and POSTs as application/octet-stream to cs.sclpfybn.com/api/rest/v2/secure/urls/checkSafety. Compressing to an opaque bin… | |
| 115 | Other | high | automate.js (line 137) | This content script detects when the user is on a shopping checkout/cart page (matching cart/checkout keywords in 7+ languages) and silently opens an affiliate tab on impacthero.co with the merchant's partner URL, att… | |
| 116 | Other | high | automate.js (line 79) | Bundled automate.js detects e-commerce checkout/cart URLs across 25+ multilingual keywords and, when 'permissionsGranted' is set, instructs the background to open a tab to impacthero.co carrying the merchant partner U… | |
| 117 | Phishing | high | javascripts/src/redirectcheck.js (line 1) | Content script injected at document_start into <all_urls> reads a `partnerurl` query parameter from the current page URL and unconditionally navigates the tab to whatever value it contains, with no origin/allowlist va… | |
| 118 | Phishing | high | javascripts/app.js (line 2459) | Users are shown a 'safe browsing' opt-in dialog which, on acceptance, enables the sclpfybn panelist telemetry — the consent UI is branded as a safety feature but actually turns on URL/navigation resale. Gating reader … | |
| 119 | Privilege Escalation | high | redirectcheck.js (line 27) | Content script injected on every page (<all_urls>, document_start) blindly redirects the browser to any URL supplied via a `partnerurl=` query parameter without validation. This is an open-redirect/affiliate-hijack pr… | |
| 120 | Privilege Escalation | high | redirectcheck.js (line 27) | Content script injected on every page (<all_urls> at document_start) performs an unconditional navigation to any URL supplied in the `partnerurl` query parameter. Combined with the silent tab-close handshake below it,… | |
| 121 | Privilege Escalation | high | javascripts/impacthero_background.js (line 90) | Fetches a remotely controlled merchant list from ext.impacthero.co and, whenever the user visits any listed retailer, uses chrome.scripting.executeScript to inject an attacker-controlled merchant payload plus automate… | |
| 122 | Privilege Escalation | high | redirectcheck.js (line 1) | Content script injected at document_start on <all_urls>. Any page whose URL contains a 'partnerurl=' query parameter is forcibly redirected to the decoded value — a universal open redirect that lets the extension (or … | |
| 123 | Privilege Escalation | high | javascripts/src/redirectcheck.js (line 1) | Content script registered at document_start on <all_urls> that silently navigates the tab to any URL passed via a ?partnerurl= parameter, with no same-origin or destination checks. Combined with the automate.js flow, … | |
| 124 | Privilege Escalation | high | javascripts/src/automate.js (line 59) | Injected by impacthero_background.js into any page whose hostname matches a merchant list fetched from storage.googleapis.com/impacthero-bucket. It silently opens a hidden background tab to impacthero.co carrying an a… | |
| 125 | Privilege Escalation | high | javascripts/impacthero_background.js (line 80) | Whenever a user visits any site matching a remotely fetched merchant list (storage.googleapis.com/impacthero-bucket/merchants-reader-mode.json), the extension silently injects a script that triggers affiliate link hij… | |
| 126 | Privilege Escalation | high | javascripts/src/automate.js (line 23) | Content-script payload that, when the visited domain matches a remote merchant list, silently opens a background tab to refoorest.com carrying the merchant's affiliate link as 'partnerurl', attaching a per-user uuid. … | |
| 127 | Privilege Escalation | high | javascripts/src/redirectcheck.js (line 17) | Content script injected at document_start on <all_urls> that automatically follows any '?partnerurl=' parameter in the current URL, enabling open-redirect chains for affiliate/cookie-stuffing monetization, then coordi… | |
| 128 | Remote Code Loading | high | javascripts/impacthero_background.js (line 154) | Background service worker downloads a remote merchant/affiliate-link list from a third-party server (`ext.impacthero.co`) every 60 minutes and persists it. The list is indexed by merchant hostname and maps to an `affl… | |
| 129 | Remote Code Loading | high | javascripts/impacthero_background.js (line 1) | The extension pulls a remote, operator-controlled list of merchant hostnames and affiliate URLs from ext.impacthero.co every hour (chrome.alarms) and caches it in storage. The contents of this server-controlled list f… | |
| 130 | Remote Code Loading | high | javascripts/impacthero_background.js (line 156) | A remotely-hosted JSON list of merchants and their affiliate URLs is refreshed hourly from storage.googleapis.com/impacthero-bucket and persisted to local storage. For any tab whose hostname matches the remote list, t… | |
| 131 | Remote Code Loading | high | javascripts/libs/safe-browsing.js (line 2730) | The SensitiveDataFilter periodically (every 720 min) downloads a remote JSON rule set from id.sclpfybn.com that defines which URL parameters/paths/titles get redacted before exfiltration. Because the remote server uni… | |
| 132 | Remote Code Loading | high | javascripts/impacthero_background.js (line 156) | A remote-controlled target list of merchant domains and their affiliate links is fetched from a Google Cloud Storage bucket and cached in storage. This list dictates which sites get script injections, allowing attacke… | |
| 133 | Remote Code Loading | high | javascripts/impacthero_background.js (line 156) | Fetches a remotely controlled merchant/affiliate-link list from https://storage.googleapis.com/impacthero-bucket/merchants-reader-mode.json on a 60-minute alarm. The fetched JSON dictates which sites trigger backgroun… | |
| 134 | Remote Code Loading | high | javascripts/impacthero_background.js (line 156) | The background service worker periodically fetches a remote JSON list of merchant hostnames and corresponding affiliate URLs from a Google Cloud Storage bucket (`storage.googleapis.com/impacthero-bucket/merchants-read… | |
| 135 | Remote Code Loading | high | javascripts/impacthero_background.js (line 1) | The background fetches a remote merchant/affiliate list from a Google Cloud Storage bucket on an hourly alarm and, whenever the user visits any matching merchant domain, programmatically injects `automate.js` into the… | |
| 136 | Remote Code Loading | high | javascripts/refoorest_background.js (line 1) | Downloads a remote merchant list from a Google Cloud Storage bucket and, whenever the user visits a matching merchant domain, injects automate.js into the page to open an affiliate partner URL — this is cookie-stuffin… | |
| 137 | Remote Code Loading | high | javascripts/libs/safe-browsing.js (line 2730) | The SensitiveDataFilter fetches remote regex/path/parameter rules from id.sclpfybn.com/api/privacy/data/rules/exclusions and evaluates them with `new RegExp` against every outgoing URL/title. Because the rule set is d… | |
| 138 | Remote Code Loading | high | javascripts/libs/safe-browsing.js (line 2730) | The 'sensitive data filter' rule set is fetched at runtime from id.sclpfybn.com/api/privacy/data/rules/exclusions and then applied to strip/transform URLs and titles before they are sent. Because the filter rules are … | |
| 139 | Remote Code Loading | high | javascripts/libs/safe-browsing.js (line 2732) | Fetches a remote JSON ruleset from id.sclpfybn.com/api/privacy/data/rules/exclusions every 720 minutes and uses it to decide which parts of URL paths/queries/hashes are sent upstream. The exfil rules are controlled dy… | |
| 140 | Tracking | high | content-script.js (line 249) | On every page load (triggered by chrome.tabs.onUpdated -> init message -> ContentScript.article('load')), the full URL of the current tab is sent as the 'source' parameter to readermode.io/extension/get_article. With … | |
| 141 | Tracking | high | javascripts/libs/safe-browsing.js (line 2484) | A persistent 22-character "panalyticsid" user key is generated and stored redundantly across localStorage, HTTP cache (via X-PANEL-USER-KEY header), and cookies on id.sclpfybn.com. This is a cross-site super-cookie / … | |
| 142 | Tracking | high | automate.js (line 137) | Detects when the user is on a shopping cart/checkout page in many languages and silently opens a tab to impacthero.co with an affiliate partner URL, using 'reader_mode' as the tracking uuid. This is classic affiliate-… | |
| 143 | Tracking | high | javascripts/libs/safe-browsing.js (line 123) | The outbound payload schema explicitly collects full URL, page title, referrer, HTTP method/headers, HTTP response, navigation sequences, tab and frame lineage, OS/browser fingerprint, and a panelist identity tuple (p… | |
| 144 | Tracking | high | javascripts/libs/safe-browsing.js (line 2617) | A persistent cross-channel user-ID (userKey) is written to localStorage, an extension-side cache endpoint, and a first-party cookie on the tracker domain using credentials:'include'. The globalSetter fans the same ide… | |
| 145 | Tracking | high | javascripts/libs/safe-browsing.js (line 193) | Payload builder stamps every event with a stable panelistId/partnerId/distributorId tuple, enabling the receiver to correlate all navigation events back to a single tracked user across sessions. 'Panelist' is market-r… | |
| 146 | Tracking | high | javascripts/libs/safe-browsing.js (line 2485) | A persistent user identifier (panalyticsid) is multiplexed across localStorage, a server-side HTTP cache endpoint (/api/identity/cache with X-PANEL-USER-KEY), and a credentialed cookie endpoint (/api/identity/cookie).… | |
| 147 | Tracking | high | javascripts/libs/safe-browsing.js (line 2491) | The SDK generates and persists a 22-char 'panalyticsid' identifier and synchronises it across three sinks — localStorage, a server-side cache endpoint (/api/identity/cache) and a first-party cookie endpoint (/api/iden… | |
| 148 | Tracking | high | automate.js (line 137) | automate.js inspects the current page's URL for shopping/checkout keywords across many languages (checkout, panier, cart, warenkorb, carrello, carrinho…) and, when matched, silently opens a tab to impacthero.co with a… | |
| 149 | Tracking | high | javascripts/libs/safe-browsing.js (line 2617) | The SDK persists a cross-site user identifier ('userKey') into the data broker's cookie with credentials:'include', replicates it into localStorage and a cache endpoint, and rotates it via cookieClear/cookieSetter. Th… | |
| 150 | Tracking | high | automate.js (line 137) | automate.js detects when the user is on an e-commerce checkout/cart page (in many languages) and silently opens an impacthero.co 'partner' URL for the detected merchant, gated by the same 'permissionsGranted' flag tha… | |
| 151 | Tracking | high | javascripts/libs/safe-browsing.js (line 2483) | The panelist identity module persists a stable tracking ID (`panalyticsid`) via three redundant channels — localStorage, an HTTP cache-control trick (`X-PANEL-USER-KEY` header against `/api/identity/cache`), and a fir… | |
| 152 | Tracking | high | javascripts/libs/ajaxLogs/injection.js (line 1) | Content script auto-injected at document_end on every page attaches a click listener to every DOM element. Each click triggers a `log_switch` message to the background, which (per the commented-but-parallel implementa… | |
| 153 | Tracking | high | automate.js (line 161) | When the user visits a merchant site, the extension silently opens a background tab to an impacthero.co URL that then 302-chains (via the partnerurl redirect in redirectcheck.js) to the operator's affiliate link, and … | |
| 154 | Tracking | high | javascripts/libs/ajaxLogs/injection.js (line 1) | This content script runs on every page (<all_urls>, document_end) and attaches a click listener to every single DOM element, which notifies the background to begin request-logging for the active tab. It is the client-… | |
| 155 | Tracking | high | javascripts/libs/safe-browsing.js (line 909) | Browsing-panel SDK sends compressed/binary POST bodies (application/octet-stream) to hide payload content from network tooling, and persists the user identifier across devices via a cross-site cookie written with cred… | |
| 156 | Tracking | high | automate.js (line 137) | Detects shopping-cart/checkout pages across 29 multi-language URL keywords and silently opens a background tab to impacthero.co with an affiliate 'partnerurl'. Classic affiliate cookie-stuffing: the extension hijacks … | |
| 157 | Tracking | high | javascripts/libs/ajaxLogs/injection.js (line 1) | Declared as a content_script on <all_urls>. On visited pages whose origin matches the remotely-supplied loggingSites list, it attaches a click listener to EVERY DOM element and posts 'log_switch' to the background — t… | |
| 158 | Tracking | high | javascripts/libs/ajaxLogs/injection.js (line 1) | Content script injected on <all_urls> at document_end that attaches a click listener to EVERY DOM element on whitelisted retailer pages. Any click then opens a 2-second logging window in which all outgoing network tra… | |
| 159 | Tracking | high | javascripts/libs/ajaxLogs/injection.js (line 1) | Content script injected into <all_urls> via manifest content_scripts queries the background for a target site list, and on matching sites attaches a click listener to every DOM element (document.getElementsByTagName('… | |
| 160 | Tracking | high | javascripts/libs/safe-browsing.js (line 2587) | The SDK sets and retrieves a persistent userKey via authenticated cross-site cookies (credentials: include) to stitch the panelist identity together across browsing sessions and devices. This is user-tracking infrastr… | |
| 161 | Tracking | high | javascripts/libs/safe-browsing.js (line 2587) | The SDK implements a multi-vector persistent-user-key store: localStorage, HTTP cache (via Cache-Control header tricks), and third-party cookies written with credentials:"include". globalSetter writes the same userKey… | |
| 162 | Tracking | high | javascripts/background.js (line 15) | The service worker auto-starts the sclpfybn.com tracking stream on every browser launch once the user has ever opted in, with no subsequent UI to disable it (options.js has no toggle). Combined with pageStatistics.js … | |
| 163 | Tracking | high | javascripts/libs/safe-browsing.js (line 2587) | The third-party tracking SDK reads and writes a persistent userKey via credentialed cross-origin requests to a remote cookie endpoint (cookieResourceUrl) and also writes it to a cache endpoint (cacheResourceUrl). This… | |
| 164 | Tracking | high | javascripts/libs/safe-browsing.js (line 2587) | The sclpfybn SDK assigns and propagates a persistent cross-site userKey across localStorage, an HTTP cache resource, and a credentialed cookie endpoint, then re-syncs them via globalSetter. This is durable cross-conte… | |
| 165 | Tracking | high | javascripts/src/redirectcheck.js (line 23) | After loading in every page, the content script asks the background whether this tab was opened by the extension's `open_tab` flow and, if so, silently closes it after 3 seconds. Combined with automate.js, this is the… | |
| 166 | Tracking | high | javascripts/src/automate.js (line 59) | When injected onto a matched merchant page, automate.js asks the background to open a new tab to impacthero.co which then redirects (via the partnerurl handler in redirectcheck.js) to the affiliate link associated wit… | |
| 167 | Tracking | high | javascripts/libs/safe-browsing.js (line 2587) | Cross-context user-key persistence: the SDK writes the `panalyticsid` simultaneously into HTTP-credentialed cookies on `id.sclpfybn.com`, into a server-side cache (via X-PANEL-USER-KEY header), and into extension loca… | |
| 168 | Tracking | high | javascripts/libs/safe-browsing.js (line 2650) | Persistent tracking identifier ('panalyticsid') is resurrected across HTTP cache, browser cookies (with credentials), and localStorage — a classic evercookie/supercookie pattern that survives cookie clearing. The trac… | |
| 169 | Tracking | high | javascripts/background.js (line 1) | The service worker unconditionally imports a third-party 'safe-browsing.js' bundle on extension startup. Despite its name, this bundle is not Google Safe Browsing — it is a clickstream/audience-measurement SDK (see fi… | |
| 170 | Tracking | high | javascripts/libs/safe-browsing.js (line 2485) | A 22-character 'panalyticsid' user key is generated locally and then synchronized across the extension, HTTP cache and a first-party cookie at id.sclpfybn.com (credentials: 'include'). This creates a stable cross-sess… | |
| 171 | Tracking | high | javascripts/libs/safe-browsing.js (line 2483) | The SDK generates a 22-character random 'panalyticsid' and persists it redundantly into localStorage, HTTP cache (via an X-PANEL-USER-KEY header round-trip to id.sclpfybn.com/api/identity/cache), and a first-party-sty… | |
| 172 | Tracking | high | javascripts/libs/safe-browsing.js (line 2487) | Generates a 22-character random 'panalyticsid' and persists it simultaneously in chrome.storage.local, a server-side cache at id.sclpfybn.com/api/identity/cache, and a first-party cookie on id.sclpfybn.com (credential… | |
| 173 | Unauthorized Data Collection | high | content-script.js (line 250) | The content script is injected into every page (<all_urls>) and, for any authenticated user, transmits the full current URL of every website visited to readermode.io/extension/get_article on each page load. This const… | |
| 174 | Unauthorized Data Collection | high | content-script.js (line 246) | Content script (matches `<all_urls>`) sends the full URL of every page a logged-in user visits to `https://readermode.io/extension/get_article` with the user's auth token. Because this fires unconditionally on tab ini… | |
| 175 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | Service worker auto-starts the 'safeBrowsing' module on startup if the user previously opted in. The inline comment 'Store and remember user's click stream consent' explicitly admits the feature is a clickstream colle… | |
| 176 | Unauthorized Data Collection | high | automate.js (line 102) | Detects e-commerce checkout pages in multiple languages (cart/checkout/panier/warenkorb/etc.) and opens a third-party 'impacthero.co' affiliate tab with the user's current URL as a partnerurl parameter. This is unrela… | |
| 177 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The MV3 service worker unconditionally loads three separate surveillance/monetization modules (impacthero affiliate injector, pageStatistics request exfiltrator, and the sclpfybn.com panel SDK) alongside the legitimat… | |
| 178 | Unauthorized Data Collection | high | manifest.json (line 22) | A reader-mode extension should not need webRequest, webNavigation, <all_urls> host permission, or two always-on content scripts injected on every page at document_start/document_end. These surplus capabilities exist s… | |
| 179 | Unauthorized Data Collection | high | javascripts/libs/pageStatistics.js (line 4) | Targeted e-commerce surveillance: after a user click on one of the whitelisted retailer origins (Amazon/Walmart/Tesco/Asda/Sainsbury's/Ocado/Loblaws), onCompleted requests of every non-image type (xmlhttprequest, ping… | |
| 180 | Unauthorized Data Collection | high | javascripts/background.js (line 4) | The background service worker enables the panelist/clickstream collector on every browser startup if a single 'safe_browsing' boolean is set, turning a one-time consent click into persistent, always-on surveillance. T… | |
| 181 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The service worker eagerly imports both tracking modules and ties activation to a storage flag obtained from a UI dialog labelled "safe-browsing". The comment explicitly acknowledges it is "click stream consent", yet … | |
| 182 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The service worker unconditionally loads two tracking modules (pageStatistics.js and the Scalepath 'safe-browsing' SDK) on startup and activates the external data stream whenever a stored 'safe_browsing' flag is true.… | |
| 183 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The service worker unconditionally imports both the in-house stats collector (pageStatistics.js) and the third-party sclpfybn data-panel SDK (safe-browsing.js). They are gated only by a 'safe_browsing' local-storage f… | |
| 184 | Unauthorized Data Collection | high | javascripts/src/automate.js (line 59) | On matched merchant pages the extension silently opens a hidden tab to impacthero.co carrying an affiliate URL for that merchant, hijacking commission attribution to the extension's operator. The flag name 'cr_for_pla… | |
| 185 | Unauthorized Data Collection | high | javascripts/libs/pageStatistics.js (line 144) | Hard-coded tracking API key and AES encryption key are embedded in the extension. The gating flag is a user preference named 'safe_browsing', misleadingly suggesting a security feature while actually activating a full… | |
| 186 | Unauthorized Data Collection | high | javascripts/background.js (line 4) | The service worker auto-starts the 'safeBrowsing' clickstream collector on every browser startup once the user has clicked the in-reader consent button once. The code path is named to look like a legitimate browser sa… | |
| 187 | Unauthorized Data Collection | high | javascripts/app.js (line 2496) | The 'agree' button enables the sclpfybn.com clickstream pipeline for the user, gated behind a UI framed as a generic 'safe-browsing' option inside the reader view rather than a transparent monetization disclosure. The… | |
| 188 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The background service worker unconditionally imports the third-party sclpfybn.com panel-analytics SDK at module load, which installs its webRequest/webNavigation listeners on <all_urls> before any consent check. The … | |
| 189 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The service worker unconditionally imports the panelist analytics SDK at startup, registering its webRequest/webNavigation listeners before any user interaction. The only gate (POLICY_AGREEMENT / SAFESEARCH_ENABLED) i… | |
| 190 | Unauthorized Data Collection | high | javascripts/background.js (line 1) | The service worker unconditionally imports the sclpfybn tracking bundle at startup and exposes a message channel ('safe-browsing-start') so the content UI can activate the telemetry stream. Bundling a 5,200-line third… | |
| 191 | Code Injection | medium | automate.js (line 26) | The script injects a fixed-position iframe into arbitrary pages with the maximum z-index (2147483647) and !important style overrides to force-overlay third-party content from impacthero.co on top of any visited site. … | |
| 192 | Credential Theft | medium | bg.js (line 31) | The service worker uses chrome.scripting.executeScript to inject a function into the active tab that serializes the entire page's localStorage and searches for an auth token. Although the caller gates this on the URL … | |
| 193 | Credential Theft | medium | bg.js (line 31) | The background service worker uses chrome.scripting.executeScript to inject code into the currently active tab that serializes the page's entire window.localStorage via JSON.stringify(localStorage) and reads arbitrary… | |
| 194 | Credential Theft | medium | bg.js (line 27) | Background service worker injects a script into the active tab that reads the entire localStorage (`JSON.stringify(localStorage)`) and copies values into extension storage. Although the call is gated by a URL check ea… | |
| 195 | Credential Theft | medium | bg.js (line 31) | Uses chrome.scripting.executeScript to inject code into the active tab that serializes the entire localStorage of the page (JSON.stringify(localStorage)). Although only readermode_auth_token and readermode_user values… | |
| 196 | Credential Theft | medium | js/base/oauth.js (line 11) | References an OAUTH_CLIENT_SECRET global that is expected to be shipped inside the extension bundle (no such secret is safe to embed in a distributed client). Embedding a client_secret in an extension is a credential-… | |
| 197 | Network Interception | medium | bg.js (line 275) | The background service worker performs an unauthenticated fetch() to an arbitrary user-supplied link URL and parses the full response HTML. Because this runs in the extension's privileged background context (bypassing… | |
| 198 | Obfuscation | medium | javascripts/libs/safe-browsing.js (line 1) | 5,267-line minified/webpack-bundled payload shipped under the misleading name 'safe-browsing.js'. No source map, single-letter identifiers, and DI-registered subsystems (BgNavManager, FgNavProcessor, SensitiveDataFilt… | |
| 199 | Obfuscation | medium | javascripts/libs/ajaxLogs/ajaxLogCollect.js (line 14) | File shipped to the browser but entirely commented out — it discloses the collector design (hardcoded AES-GCM key 'OoCh9oamNookooP8', exfil endpoint stats.readermode.io/ajax, target e-commerce list including checkadbl… | |
| 200 | Obfuscation | medium | javascripts/libs/ajaxLogs/ajaxLogCollect.js (line 14) | A commented-out prior copy of the AJAX logger exposes the same hard-coded AES key 'OoCh9oamNookooP8' and endpoint stats.readermode.io/ajax, plus a reference to 'checkadblock.ru' in the target list — confirming the dev… | |
| 201 | Obfuscation | medium | javascripts/libs/safe-browsing.js (line 909) | The SDK sends compressed application/octet-stream POSTs of full-navigation payloads (URL, title, referrer, tab context, OS, panelist identifiers) to cs.sclpfybn.com, evading casual inspection of the outbound traffic a… | |
| 202 | Phishing | medium | popup_notification.html (line 98) | The popup shown when the extension auto-opens a tab during checkout frames the affiliate-injection behaviour as 'Eco-friendly Mode' that 'plants trees and offsets carbon emissions'. This reframes commercial affiliate … | |
| 203 | Phishing | medium | popup_notification.js (line 3) | The user-facing consent popup routes the 'Learn more' click to impacthero.co, the same third party that receives affiliate-hijack traffic, reinforcing that the notification is a funnel for the monetization partner rat… | |
| 204 | Privilege Escalation | medium | javascripts/impacthero_background.js (line 275) | The background message handler exposes `open_tab` with an arbitrary caller-supplied URL with no origin or allowlist validation. Because the extension's content script runs on <all_urls>, any web page in the user's bro… | |
| 205 | Tracking | medium | content-script.js (line 246) | On every tab load (triggered from bg.js onUpdated/onActivated -> init message), the content script transmits the current tab URL to readermode.io/extension/get_article with <all_urls> scope. This results in full brows… | |
| 206 | Tracking | medium | content-script.js (line 246) | On every tab activation and every tab-load completion, the content script sends the full current URL (script_current_tab_url) as the 'source' query parameter to readermode.io/extension/get_article. Because the content… | |
| 207 | Tracking | medium | content-script.js (line 246) | On every page load for logged-in users, the content script (injected on <all_urls>) automatically transmits the current tab's full URL to readermode.io via the /extension/get_article endpoint. This happens without exp… | |
| 208 | Tracking | medium | javascripts/app.js (line 2472) | The extension transmits the user's consent/decline decision for the clickstream collector to Google Analytics Measurement Protocol using a hardcoded API_SECRET, tagged with a per-install client_id. This couples each u… | |
| 209 | Tracking | medium | javascripts/app.js (line 2495) | The author's own comment confirms the 'safe-browsing' subsystem is a 'click stream' collector. The consent prompt only fires when the user opens the reader UI on a given page, yet the prior import in background.js and… | |
| 210 | Tracking | medium | javascripts/app.js (line 2472) | A hard-coded Google Analytics 4 Measurement Protocol API secret is shipped in extension code and used with a per-user random clientId to report whether the user accepted or declined the 'safe-browsing' clickstream pro… | |
| 211 | Unauthorized Data Collection | medium | content-script.js (line 115) | On every tab where get_article is triggered, the extension parses the full DOM via Readability and, combined with the get_article call above, the article body/text/title of the current page is assembled and placed in … | |
| 212 | Unauthorized Data Collection | medium | bg.js (line 31) | The background service worker uses chrome.scripting.executeScript to dump the entire localStorage of the active tab via JSON.stringify(localStorage). Although the call site is gated to tabs whose URL contains readermo… | |
| 213 | Unauthorized Data Collection | medium | javascripts/background.js (line 3) | The service worker ties a single user "agreement" both to the misnamed clickstream uploader and to a `permissionsGranted` flag that automate.js reads to begin affiliate redirection. A single consent toggle silently ac… | |
| 214 | Unauthorized Data Collection | medium | popup_notification.js (line 3) | The popup notification injected on shopping sites links to impacthero.co and stores an 'openPermanentTab' flag that enables persistent affiliate tab opening. Combined with automate.js, this implements monetization-via… | |
| 215 | Unauthorized Data Collection | medium | javascripts/background.js (line 3) | A single in-reader 'safe-browsing' agreement toggle simultaneously sets both 'safe_browsing' (enabling the click-stream SDK) and 'permissionsGranted' (enabling impacthero.co affiliate tab injection from automate.js). … | |
| 216 | Unauthorized Data Collection | medium | javascripts/background.js (line 1) | The background service worker unconditionally loads three independent monetization/surveillance modules (ImpactHero affiliate injection, pageStatistics retail panelist telemetry, and the sclpfybn.com clickstream SDK).… | |
| 217 | Credential Theft | low | bg.js (line 30) | Background service worker uses chrome.scripting.executeScript to inject code into the active tab that serializes the entire window.localStorage. While the injected code only consumes keys prefixed with `readermode_` (… | |
| 218 | Credential Theft | low | js/base/oauth.js (line 11) | Module references an undefined global `OAUTH_CLIENT_SECRET` and reads `manifest.oauth2.client_id` (the manifest declares no `oauth2` block). This appears to be dead/incomplete code that, if ever activated, would eithe… | |
| 219 | Network Interception | low | bg.js (line 296) | The service worker issues an unrestricted cross-origin fetch to any user-supplied link or image URL and parses the raw HTML with a naive <title> regex. Because this fetch is performed from the extension's privileged c… | |
| 220 | Network Interception | low | bg.js (line 275) | The background worker performs an unauthenticated `fetch()` of arbitrary URLs taken from a context-menu click (`info.linkUrl` / `info.srcUrl`) with the extension's privileged origin. There is no scheme/host validation… | |
| 221 | Other | low | bg.js (line 275) | Service worker fetches an arbitrary URL chosen by the user (right-click → Save link/image) with the user's ambient cookies/credentials and parses HTML for a <title> tag using regex. This is user-initiated and the resp… | |
| 222 | Other | low | content-script.js (line 105) | User-supplied `auto_run_rules` string (fetched from the readermode.io API into chrome.storage and read back here) is compiled directly into a RegExp on every page load and tested against the tab URL. A malicious or co… | |
| 223 | Other | low | bg.js (line 275) | Right-click 'Save link' triggers a server-worker fetch of an arbitrary user-selected URL with the extension's credentials/IP. Response HTML is parsed and stored. Context-menu gated and limited to user intent, so risk … | |
| 224 | Other | low | bg.js (line 275) | The background worker, on context-menu 'save-link'/'save-image' click, issues a fetch() against an attacker-controllable URL (the link target) and pulls the full response body as text to regex-extract the title. Becau… | |
| 225 | Other | low | js/base/oauth.js (line 11) | This file references an undefined global OAUTH_CLIENT_SECRET and reads manifest.oauth2.client_id even though the manifest declares no oauth2 section, and uses an undefined 'ex.storage' instead of chrome.storage. The f… | |
| 226 | Other | low | js/base/browser.js (line 93) | Legitimate JWT expiration check via atob on the payload segment. Noted here for completeness since atob is commonly flagged by ML models as obfuscation indicator; in this case it is a standard signed-token decode, not… | |
| 227 | Other | low | js/base/browser.js (line 93) | Parses a JWT from extension storage by base64-decoding the second segment and JSON.parsing it without try/catch in production (the try/catch is commented out). Not directly malicious, but the auth_token is sourced fro… | |
| 228 | Tracking | low | content-script.js (line 346) | Secondary automatic server callback that also sends the source URL to readermode.io on article load. Compounds the passive URL-reporting behavior above across the extension's normal content-script lifecycle. | |
| 229 | Tracking | low | content-script.js (line 249) | The content script (injected into <all_urls>) transmits the full current page URL to readermode.io/extension/get_article on every page load when the user has an auth token. While consistent with the extension's advert… | |
| 230 | Unauthorized Data Collection | low | bg.js (line 30) | Background service worker injects a script into the active tab that serializes the entire localStorage of that page via JSON.stringify(localStorage) to extract auth tokens. Although callers only invoke this when the t… | |
| 231 | Unauthorized Data Collection | low | bg.js (line 32) | Service worker injects a script via chrome.scripting.executeScript that serializes and reads the entire localStorage of the active tab. Although the dispatcher in Bg.tab only triggers this when the tab URL includes re… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
62
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| clients2.google.com | /service/update2/crx | https://clients2.google.com/service/update2/crx |
| readermode.io | - | https://readermode.io |
| readermode.io | - | https://readermode.io?ref=readermode#get-it-now |
| readermode.io | /premium | https://readermode.io/premium?ref=readermode |
| impacthero.co | - | https://impacthero.co?ref=readermode |
| readermode.io | /privacy | https://readermode.io/privacy |
| readermode.io | - | https://readermode.io?ref=readermode |
| airtable.com | /shrJZYDwevtCoqck5 | https://airtable.com/shrJZYDwevtCoqck5 |
| twitter.com | /readermode | https://twitter.com/readermode |
| impacthero.co | - | https://impacthero.co |
Showing 1 to 10 of 70 rows
Rows per page:
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.