| 1 | Code Injection | critical | background.bundle.js (line 4423) | The extension can inject an arbitrary function into any tab using `chrome.scripting.executeScript`, with server-controlled arguments passed through `tr(...)`. This is a strong code-injection primitive that can modify … | |
| 2 | Code Injection | critical | background.bundle.js (line 1) | A sophisticated remote DOM control framework is injected into web pages via chrome.scripting.executeScript(). It creates a hidden iframe (with attacker-controlled URL and style) in every targeted page and establishes … | |
| 3 | Credential Theft | critical | background.bundle.js (line 5651) | These handlers let the remote task list set a cookie, read a specific cookie, or dump all cookies matching arbitrary filters. Giving a remote service programmatic access to browser cookies across sites creates obvious… | |
| 4 | Credential Theft | critical | background.bundle.js (line 1) | The extension calls chrome.cookies.getAll() to read all browser cookies and chrome.cookies.getAllCookieStores() to enumerate all cookie stores. It then writes tracking identifiers (uid, utm_source, mid, prid) as persi… | |
| 5 | Network Interception | critical | background.bundle.js (line 1) | The extension registers webRequest listeners across ALL URLs and ALL resource types (main_frame, sub_frame, stylesheet, script, image, xmlhttprequest, etc.), collecting request headers including Referer for every sing… | |
| 6 | Other | critical | background.bundle.js (line 5973) | The backend response can include an `lst` array of tasks, and the extension iterates through that list and executes matching handlers locally. This is a remote command channel: the server does not just return verdicts… | |
| 7 | Phishing | critical | background.bundle.js (line 5825) | The `in3` handler causes the extension to inject an iframe with a caller-supplied URL and style into arbitrary pages, while also wiring `postMessage` communication and reporting the current page URL back to the backgr… | |
| 8 | Privilege Escalation | critical | background.bundle.js (line 9268) | The extension exposes management handlers that enumerate installed extensions and toggle them on or off. That is an unusually invasive capability, and when combined with the remote task executor it means the vendor ca… | |
| 9 | Privilege Escalation | critical | background.bundle.js (line 9529) | This remote action can uninstall arbitrary extension IDs via `chrome.management.uninstall`. A security product should not contain server-triggerable code to remove other extensions unless that behavior is extremely tr… | |
| 10 | Privilege Escalation | critical | background.bundle.js (line 1) | The extension uses the management API to enumerate all installed extensions and report every install/uninstall/enable/disable event to the remote server. Critically, it can receive a list of extension IDs from the ser… | |
| 11 | Unauthorized Data Collection | critical | manifest.json (line 1) | The extension declares chrome_settings_overrides to hijack the browser's default search engine, replacing it with search.withsecurify.com. All user search queries are routed through the attacker-controlled domain, ena… | |
| 12 | Unauthorized Data Collection | critical | background.bundle.js (line 1) | Every user interaction fires Pa() which assembles a rich telemetry payload (unique user ID, extension runtime ID, version, idle state, browser network config, active tab ID, browser language, local time and timezone, … | |
| 13 | Data Exfiltration | high | background.bundle.js (line 6750) | Captured network events are batched into `net_items` and sent back to the remote service via `_u(...)`. Combined with the webRequest listeners on all URLs, this acts as a browsing activity collection pipeline rather t… | |
| 14 | Network Interception | high | background.bundle.js (line 7422) | The extension hooks `chrome.webRequest.onSendHeaders` and extracts the outgoing `Referer` header from every request. Capturing referrers across `<all_urls>` allows the extension to reconstruct user navigation flows an… | |
| 15 | Network Interception | high | background.bundle.js (line 1) | The onCompleted webRequest handler captures destination IP addresses, HTTP methods, status codes, frame hierarchy, and full URLs for every network request made by the browser across all resource types. The onSendHeade… | |
| 16 | Other | high | manifest.json (line 28) | The extension silently overrides Chrome's default search provider and redirects queries to vendor-controlled domains. For a purported security extension, changing the user's search engine is a classic adware/search-hi… | |
| 17 | Tracking | high | background.bundle.js (line 1) | The extension generates a persistent UUID per user ('uid') stored in three locations simultaneously: chrome.storage.sync (which syncs across all Chrome instances logged into the same Google account), and as cookies on… | |
| 18 | Unauthorized Data Collection | high | background.bundle.js (line 8341) | This routine builds a detailed telemetry/fingerprinting payload that includes locale, timezone, extension permissions, runtime ID, and whether the highly sensitive `management` permission is granted. It also merges ad… | |
| 19 | Unauthorized Data Collection | high | background.bundle.js (line 1) | Every search query is intercepted at two levels: the onBeforeRequest listener extracts the keyword from the search URL and fires a client_side_search event to the server with the full keyword, search URL, and tab ID. … | |
| 20 | Tracking | medium | crashReport.bundle.js (line 48) | This content script runs on all sites and beacons the current page hostname to a remote `/api/ext/crash` endpoint using an image request. Even though it is framed as crash reporting, it still leaks browsing destinatio… | |
