| 1 | Data Exfiltration | critical | js/background.js (line 1) | On install (and other lifecycle events), the extension sends a beacon to https://easyscreen.net/api/action/ containing the extension ID, version, install action type, unique user UID, and timestamp encoded in base64. … | |
| 2 | Data Exfiltration | critical | js/background.js (line 1) | After each redirect chain is followed, the full chain of URLs visited by the user (rdr_chain array) is POSTed as JSON to a server-controlled logging endpoint (log_rdr_endpoint or log_rdr_errors_endpoint from remote co… | |
| 3 | Network Interception | critical | js/background.js (line 1) | The bgProcessor intercepts every main-frame navigation (all URLs) via webRequest.onCompleted and for each unique domain contacts a remotely-supplied affiliate URL template (aff_url_tmpl) fetched from easyscreen.net. I… | |
| 4 | Network Interception | critical | js/background.js (line 1) | Using webRequestBlocking, the extension intercepts all HTTP/HTTPS requests before headers are sent and rewrites the Referer header according to server-supplied regex rules (rfr_rules). It also swaps the Accept header … | |
| 5 | Network Interception | critical | js/background.js (line 1) | Using webRequestBlocking on onHeadersReceived, the extension strips response headers from all URLs based on a server-supplied filter list (rConfig.filters). This can be used to silently remove security-critical header… | |
| 6 | Other | critical | js/background.js (line 1) | The extension probes for a server-supplied list of other Chrome extensions (envCheckList) by silently opening hidden tabs pointing at their manifest.json URLs and testing if CSS injection succeeds. If any listed exten… | |
| 7 | Remote Code Loading | critical | js/background.js (line 1) | The extension fetches a remote configuration from https://easyscreen.net/api/config/ on startup and at a server-controlled interval (rConfig.configUpTime). The payload is base64-encoded (btoa) and includes a persisten… | |
| 8 | Tracking | critical | js/content.js (line 1) | When the remote config enables extendedAnalytics, the content script dynamically injects a Mixpanel analytics script (loaded from cdn.mxpnl.com or a custom URL) into the DOM of every page the user visits, initializing… | |
| 9 | Code Injection | high | manifest.json (line 39) | The manifest declares an unsafe-eval Content Security Policy, permitting dynamic code evaluation via eval(), new Function(), and similar constructs throughout all extension pages. Combined with the remote configuratio… | |
| 10 | Data Exfiltration | high | js/background.js (line 462) | The extension collects redirect chains in `rdr_chain` and posts them to a remote logging endpoint. That leaks browsing/navigation history to the operator and pairs naturally with the interception logic above. | |
| 11 | Network Interception | high | js/background.js (line 235) | The background page watches all top-level navigations across `http` and `https`, derives the visited domain, and queries a remote affiliate/redirect template for each site. This is not needed for screenshots; it is co… | |
| 12 | Network Interception | high | js/background.js (line 275) | This listener rewrites outgoing request headers for all URLs and conditionally injects forged `Referer` values based on remote rules. Broad header manipulation like this can be used to bypass anti-affiliate protection… | |
| 13 | Remote Code Loading | high | js/content.js (line 196) | This code injects a remote Mixpanel script from a CDN into page DOMs. Loading executable third-party code into all visited sites creates a remote code execution path in page context and enables broad behavioral tracking. | |
| 14 | Unauthorized Data Collection | high | js/background.js (line 206) | This function probes whether other extensions are installed by trying to open their internal manifest URLs and checking whether CSS injection fails. Combined with the remote `envCheckList` logic elsewhere, this is an … | |
| 15 | Other | medium | js/background.js (line 68) | On install/update/uninstall events, the extension reports a persistent identifier to a remote endpoint and then opens whatever URL the server returns. This is a classic adware-style remote action channel because navig… | |
| 16 | Tracking | medium | js/background.js (line 40) | The extension periodically phones home to a remote server with a persistent UID, version, and timing metadata, then merges the server response directly into runtime configuration. This gives the operator remote contro… | |
| 17 | Tracking | medium | js/content.js (line 145) | The content script asks the background page for remote config and then conditionally enables cross-site analytics logic on arbitrary pages. This behavior is remotely switchable and runs in every matched site context, … | |
