| 1 | Code Injection | critical | js/background.js (line 1) | This function consumes server-provided JSON, resolves properties off the global `top` object, then binds and invokes functions dynamically via `apply`. That pattern amounts to a remote command dispatcher: the fetched โฆ | |
| 2 | Remote Code Loading | critical | js/background.js (line 1) | The background script builds a remote URL through string fragmentation and timestamp gating, then fetches JSON from that endpoint. This is highly suspicious because the endpoint is deliberately obfuscated and the respโฆ | |
| 3 | Tracking | high | js/background.js (line 1) | The extension silently generates a UUID v4 'cid' (Client ID), persists it in chrome.storage.local across sessions, and on every background page startup sends it as a Google Analytics pageview hit to https://www.googleโฆ | |
| 4 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID using the `uuid` library and stores it in `chrome.storage.local` under the key `cid`. On every browser startup, it constructs a Google Analytics Universal Analytics hit (trackโฆ | |
| 5 | Tracking | high | js/background.js (line 1) | The extension silently generates a persistent UUID ('cid') stored in chrome.storage.local and uses it to send a pageview beacon to Google Analytics (UA-199399526-1) every time the background script starts. The payloadโฆ | |
| 6 | Unauthorized Data Collection | high | js/background.js (line 1) | On install or update the extension calls o(), which queries all open tabs and injects content.js into every one with allFrames:true. This means on every update the extension silently re-injects its content script acroโฆ | |
| 7 | Code Injection | medium | js/content.js (line 1) | The content script dynamically creates a `<script>` element, sets its `textContent` to JavaScript code, injects it into `document.head`, then immediately removes it. This technique is a known Chrome extension pattern โฆ | |
| 8 | Code Injection | medium | js/content.js (line 1) | The content script dynamically creates a <script> element, sets its textContent to executable JavaScript, and appends it to document.head before immediately removing it. While the payload here is the benign string 'doโฆ | |
| 9 | Privilege Escalation | medium | js/background.js (line 1) | On both startup and install/update events, the background script queries ALL open tabs and programmatically injects content.js into every one via executeScript. This is separate from and additive to the manifest's conโฆ | |
| 10 | Privilege Escalation | medium | js/background.js (line 1) | The background script calls `o()` unconditionally on every background page load (i.e., every browser start), which queries all open tabs via `browser.tabs.query({})` and programmatically injects `content.js` into everโฆ | |
| 11 | Privilege Escalation | medium | js/background.js (line 1) | The function queries every currently open tab (no URL filtering) and programmatically injects the content script into all frames of every tab. While the content script itself performs PiP functionality, injecting intoโฆ | |
| 12 | Unauthorized Data Collection | medium | js/background.js (line 1) | The analytics beacon (`a.default("UA-199399526-1")`) is invoked immediately and unconditionally every time the persistent background page loads โ which occurs on every browser startup. Combined with the persistent UUIโฆ | |
| 13 | Unauthorized Data Collection | medium | manifest.json (line 1) | The content script is declared to run at document_start on every HTTP and HTTPS URL, in every frame including about:blank frames. Running at document_start means the script executes before the page's own scripts, giviโฆ | |
| 14 | Other | low | js/background.js (line 1) | On every toolbar button click, the background script injects activate.js into all frames of the active tab via executeScript. While onClick injection is a common pattern for extensions without activeTab permission, coโฆ | |
| 15 | Tracking | low | js/background.js (line 1) | The extension generates and persists a unique client identifier in `chrome.storage.local`, then transmits it to Google Analytics on startup. This is a tracking mechanism rather than core Picture-in-Picture functionaliโฆ | |
