| 1 | Credential Theft | high | browserActionPopup.js (line 1) | The extension performs a credentialed fetch (sending all session cookies) to a Microsoft silent-login endpoint, parses hidden form fields (t, ANON, NAP — Microsoft Account tokens) from the response HTML via regex, the… | |
| 2 | Remote Code Loading | high | skypeOptionsMenu.js (line 1) | The extension implements a JSONP-based remote script loader that dynamically creates a `<script>` element and injects it into the page `<head>` with a URL-controlled `src` attribute and a globally registered callback.… | |
| 3 | Remote Code Loading | high | browserActionPopup.js (line 1) | A `<script>` element is dynamically created with its `src` derived from a remotely-configurable `meetNowWidgetBlobPath` value fetched from a Skype ECS configuration service. The previously silently-extracted Skype aut… | |
| 4 | Remote Code Loading | high | browserActionPopup.js (line 1) | Extension configuration is fetched via JSONP by dynamically injecting a `<script>` tag whose `src` is the config URL with a `callback=skype_sxt_ecs_callback` parameter. JSONP bypasses fetch-based CSP restrictions and … | |
| 5 | Remote Code Loading | high | contentscript.js (line 1) | The content script dynamically creates and injects a script element with an externally-supplied src URL into the page's <head>, executing arbitrary remote JavaScript in the page context. This JSONP loader is gated on … | |
| 6 | Tracking | high | background.js (line 1) | The extension generates a persistent UUID fingerprint stored in localStorage under key 'sxt-fingerprint' and transmits it as PIIType.Identity alongside the user's Skype ID, screen dimensions, login status, and app ver… | |
| 7 | Code Injection | medium | manifest.json (line 10) | The manifest explicitly permits `unsafe-eval` in its Content Security Policy, allowing dynamic code execution via eval(), new Function(), and setTimeout/setInterval with string arguments across all extension pages. Th… | |
| 8 | Credential Theft | medium | skypeOptionsMenu.js (line 1) | The silent login flow silently acquires a Skype auth token using a fixed `client_id` and a redirect URI pointing to `https://latest-swx.cdn.skype.com/lwc/connect.html` — a CDN-hosted page. The acquired token is cached… | |
| 9 | Credential Theft | medium | browserActionPopup.js (line 1) | The extension uses `chrome.cookies.set` to programmatically write a CSRF token cookie into the `.skype.com` domain scope. While framed as CSRF protection, an extension silently writing cookies to a third-party domain … | |
| 10 | Credential Theft | medium | skypeOptionsMenu.js (line 1) | Scraped Microsoft Account session tokens are POST-ed to the MSA callback endpoint and the resulting Skype auth token is extracted via regex. This is a second, independent implementation of silent token extraction in t… | |
| 11 | Other | medium | browserActionPopup.js (line 1) | A hidden HTML form is programmatically constructed and auto-submitted to `https://web.skype.com/` targeting an `untrusted-iframe`. The form carries a `state` value and URL parameters derived from `postRedirectParams`,… | |
| 12 | Remote Code Loading | medium | background.js (line 1) | The extension fetches live runtime configuration (feature flags, URLs, ECS version) from remote servers a.config.skype.com and b.config.skype.com at startup and on a scheduled interval (ecsUpdateInMinutes + random jit… | |
| 13 | Tracking | medium | skypeOptionsMenu.js (line 1) | The `AriaPublisher.sendTelemetryReport` method collects and transmits telemetry events via Microsoft's Aria/1DS SDK, attaching `screenHeight`, `screenWidth`, `sessionId`, `version`, `hasLoggedIn`, `identityType`, and … | |
| 14 | Tracking | medium | browserActionPopup.html (line 1) | The popup loads `aria-web-telemetry-2.7.2.min.js` — Microsoft's Aria/1DS telemetry SDK — as a bundled but fully minified and opaque script. Aria is a full-featured telemetry collector capable of transmitting device me… | |
| 15 | Tracking | medium | browserActionPopup.js (line 1) | The extension collects telemetry events including custom properties and timestamps and relays them via `chrome.runtime.sendMessage` and through the Microsoft ARIA/1DS telemetry logger loaded from the bundled `aria-web… | |
| 16 | Tracking | medium | skypeOptionsMenu.js (line 1) | The extension stores a `FINGERPRINT_KEY` (`sxt-fingerprint`) alongside the Skype token and a heartbeat timestamp that refreshes every 60 seconds, indicating persistent device fingerprinting tied to auth state. The con… | |
| 17 | Tracking | medium | background.js (line 1) | The device fingerprint (UUID persisted in localStorage) is appended as a URL fragment parameter '#fp=' to the extension uninstall URL sent to a remote server when the user removes the extension. Additionally, a heartb… | |
| 18 | Unauthorized Data Collection | medium | skypeOptionsMenu.js (line 1) | A persistent fingerprint UUID is generated and stored in `localStorage` under the key `sxt-fingerprint` if one does not already exist, then attached to every outgoing telemetry event with a PII classification of `PIIT… | |
| 19 | Unauthorized Data Collection | medium | skypeOptionsMenu.js (line 1) | A duplicate implementation of the credentialed MSA silent-login flow exists in `skypeOptionsMenu.js`, fetching the login page with `credentials:include` and regex-scraping Microsoft Account tokens (t, ANON, NAP) from … | |
| 20 | Unauthorized Data Collection | medium | contentscript.js (line 1) | The content script — injected into every HTTP, HTTPS, and file:// URL on the system — captures the full page URL (location.href) and hostname on every page load and sends a readiness message to the background service … | |
| 21 | Code Injection | low | contentscript.js (line 1) | The bundled code uses the indirect eval pattern `(0,eval)("this")` to obtain a reference to the global object, bypassing strict-mode restrictions on `this`. While this is a known KnockoutJS bundling pattern, it requir… | |
| 22 | Credential Theft | low | skypeOptionsMenu.js (line 1) | The `getProfileAsync` method sends the raw Skype authentication token in the `x-skypetoken` request header to `https://profile.skype.com/profile/v1/users/self/profile` with `credentials: 'include'`, which also transmi… | |
| 23 | Credential Theft | low | skypeOptionsMenu.js (line 1) | The `getSkypeId` method decodes the payload segment of a JWT/Skype token by splitting on `.` and applying `atob()` (Base64 decode) to extract the `skypeid` claim without validating the token signature. The decoded Sky… | |
| 24 | Other | low | config.json (line 1) | The config file hardcodes three distinct Chrome extension IDs (internal, dogfood, production) and a Firefox extension ID. A production extension aware of internal/debug extension IDs could potentially communicate with… | |
| 25 | Other | low | skypeOptionsMenu.html (line 6) | The options page declares `ISO-8859-5` (Cyrillic) as its charset rather than the standard UTF-8, which is anomalous for an English-language Microsoft extension page and could cause unexpected byte-sequence interpretat… | |
| 26 | Tracking | low | browserActionPopup.html (line 1) | The popup HTML bundles and loads `aria-web-telemetry-2.7.2.min.js`, Microsoft's Aria/1DS telemetry SDK, which transmits behavioral telemetry to Microsoft's data collection infrastructure on every popup open. The SDK i… | |
