记灵Start

The bundled manifest declares `https://*/*` and `http://*/*` as host_permissions, granting the extension read/write access to every website the user visits. The CWS-published manifest lists only `https://suggestion.baidu.com/` as a host_permission. This gap — disclosing narrow permissions publicly while bundling broad ones — is a standard evasion technique used by malicious extensions to pass store review. Combined with the `scripting` permission, these host_permissions enable silent JavaScript injection into any page.

{  "host_permissions": [    "https://api.remeins.com/",    "https://static.remeins.com/",    "https://bres.vmx.wang/",    "https://remeins.com/",    "https://*/*",    "http://*/*"  ]}

Every search query the user types is sent to `https://api.remeins.com/start/su` (via `mxpost` which automatically appends the user auth token `vtoken`). Rather than contacting Baidu's suggestion API directly (as the description implies), all queries are proxied through the publisher's server, allowing remeins.com to maintain a server-side log of every search keyword tied to the authenticated user identity. This constitutes undisclosed server-side collection of search query history.

async function l(t, e) {  const i = (t || "").trim();  if (!i) return [];  if ("function" !== typeof e) return [];  const s = await e("start/su", {    wd: i  });  return c(s)}

The popup page's message handler accepts an `accessCode` (auth token) from any window without validating `event.origin`. Although the popup is a chrome-extension:// page (reducing direct web exposure), any other extension or privileged context that can post a message to the popup can silently overwrite the stored auth token, potentially hijacking the user's remeins.com session or replacing it with an attacker-controlled token. The new-tab page correctly gates on `t.origin.startsWith('https://remeins.com')` (app.ea566fe1.js:2967) but the popup does not.

window.addEventListener('message', (event) => {  if (!event.data || !event.data.accessCode) {    return;  }  persistToken(event.data.accessCode)    .then(() => {      ...loaduserinfo();    });});