Subway Surfers

The parent-side `setupParent()` persists intercepted cookie and localStorage data to `chrome.storage.local` (durable extension storage) and continuously re-broadcasts it to the iframe every 1000ms via `postMessage` with a wildcard target origin (`"*"`). The `message` event listeners on both sides accept messages from any origin without validation, allowing a malicious third-party page to inject fake cookie/storage data or receive exfiltrated cookie payloads if it can load the extension's game page in a cross-origin iframe.

window.addEventListener("message", async function(event) {  if (!event.data) return;  if (!event.data.indexOf("cookies:")) {    COOKIE = (event.data + "")      .substring("cookies:".length);    source = event.source;  }  if (!event.data.indexOf("local:")) {    const storageStr = (event.data + "")      .substring("local:".length);    source = event.source;    if (storageStr) {      const json = JSON.parse(storageStr);      if (typeof json === "object") {        storage = json;      }    }  }  READY = true;});}function setupParent() {  const sandbox = document.getElementsByTagName("iframe")[0];  const reportChild = () => {    chrome.storage.local.get(["cookies", "local"], (e) => {      const c = e.cookies ? e.cookies : "";      sandbox.contentWindow.postMessage("cookies:" + c, "*");      const l = e.local ? e.local : "";      sandbox.contentWindow.postMessage("local:" + l, "*");    });  };  window.addEventListener("message", async function(event) {    if (!event.data) return;    if (!event.data.indexOf("set:")) {      COOKIE = (event.data + "")        .substring("set:".length);      chrome.storage.local.set({        cookies: COOKIE      });    }    if (!event.data.indexOf("setLocal:")) {      const storageStr = (event.data + "")        .substring("setLocal:".length);      chrome.storage.local.set({        local: storageStr      });    }  });  setInterval(reportChild, 1e3);  reportChild();}

The extension declares a content script (img.js) that runs on every HTTPS page the user visits (`https://*/*`) at `document_start`, the earliest possible execution point. This is entirely unnecessary for a game extension and grants covert DOM access and script execution capability across every website. No corresponding `host_permissions` entry is declared, yet MV3 content_scripts matches effectively function as host grants approved silently at install time.

{  "content_scripts": [    {      "matches": [        "https://*/*"      ],      "js": [        "img.js"      ],      "run_at": "document_start"    }  ]}

This file is injected as a content script into every HTTPS page at document_start, yet it contains a banner-ad injection framework: it fetches an ad payload (URL + image) from response object `r` and injects a fixed-position 728×90px clickable ad that navigates to an externally controlled URL. While currently gated on `r` being defined (preventing immediate execution in typical content-script context), the entire adware delivery mechanism is present and can be activated by any co-loaded script that defines `r` — including a future silent update.

if (document.location.hostname === chrome.runtime.id) {  function applyCss(d, styles) {    for (const [key, value] of Object.entries(styles)) d.style[key] = value;  }  setTimeout(async () => {    if (typeof r === "undefined") {      return;    }    const data = await r.json();    if (data && data.url && data.img) {      const img = document.createElement("IMG");      img.addEventListener("load", () => {        const a = document.body.appendChild(document.createElement("a"));        a.setAttribute("href", data.url);        a.style.backgroundImage = 'url("' + data.img + '")';        a.setAttribute("target", "_blank");        applyCss(a, {          position: "fixed",          bottom: "0",          left: "0",          width: "728px",          height: "90px",        });        a.classList.add("promo");      });    }  });}

The script overrides the native `document.cookie` property via `Object.defineProperty`, intercepting all cookie reads and writes within the sandboxed page. Any cookie value longer than 100 characters is captured and immediately broadcast via `postMessage` to the parent frame using a wildcard origin (`"*"`), meaning any page that has embedded this extension page in an iframe could receive the cookie payload.

var COOKIE = "";var source = null;function setupSandbox() {  Object.defineProperty(document, "cookie", {    get: function() {      return COOKIE;    },    set: function(value) {      if (value && value.length > 100) {        COOKIE = value;        source && source.window.postMessage("set:" + COOKIE, "*");      }    },  });

The sandbox CSP allows `'unsafe-eval'` and `'unsafe-inline'` across every directive (script-src, object-src, child-src, worker-src, script-src-elem). This permits arbitrary dynamic code generation via `eval()`, `new Function()`, and inline `<script>` blocks within the sandboxed page, eliminating the primary XSS mitigations that CSP is meant to provide.

{  "content_security_policy": {    "sandbox": "sandbox allow-scripts allow-pointer-lock; script-src 'self' 'unsafe-eval' blob: 'unsafe-inline'; object-src 'self' 'unsafe-eval' blob: 'unsafe-inline';child-src 'self' 'unsafe-eval' blob: 'unsafe-inline' ; worker-src 'self' 'unsafe-eval' blob: 'unsafe-inline'; script-src-elem 'self' 'unsafe-eval' blob: 'unsafe-inline'"  }}