| 1 | Code Injection | critical | js/content.js (line 1) | The content script intercepts access to iframe contentWindow and contentDocument properties and injects script code into every iframe context by calling wZ.eval() with a dynamically constructed function string. This g… | |
| 2 | Credential Theft | critical | js/content.js (line 1) | The content script relays actual cookie name and value pairs (cookieName, cookieValue) along with domain and third-party classification to the background page via SAVE_COOKIE_LOG_EVENT messages. This means every cooki… | |
| 3 | Network Interception | critical | js/background.js (line 1) | Multiple webRequest listeners cover all URLs including requestBody access, outgoing request headers, and incoming response headers. This grants the extension full visibility into and ability to modify all network traf… | |
| 4 | Phishing | critical | js/background.js (line 1) | A scriptlet decodes a base64-encoded URL via atob(), stops all page loading, nullifies the unload handler, and forcibly redirects the browser to the decoded destination. This monitors a window property and triggers th… | |
| 5 | Code Injection | high | js/background.js (line 1) | The extension dynamically injects arbitrary JavaScript code strings (via the code property of executeScript, not just file references) into web pages at document_start, including into about:blank frames. This allows t… | |
| 6 | Credential Theft | high | js/content.js (line 1) | The content script continuously polls document.cookie every 1000ms on all visited pages via setInterval, monitoring for any cookie changes and invoking a callback with both old and new cookie values. This grants the e… | |
| 7 | Credential Theft | high | js/background.js (line 1) | The background script intercepts outgoing Cookie request headers and incoming Set-Cookie response headers on all network requests, parsing and storing them into an in-memory requestContextStorage map. Cookie values ar… | |
| 8 | Data Exfiltration | high | js/background.js (line 1) | Full URLs of web pages are sent via XHR POST to https://chrome.adtidy.org/url-report.html. This is direct exfiltration of the user's browsing history to a third-party server. The URL parameter encodes the complete pag… | |
| 9 | Network Interception | high | js/background.js (line 1) | The extension registers blocking webRequest listeners across every request lifecycle phase (onBeforeRequest, onBeforeSendHeaders, onHeadersReceived) for all URLs, including access to requestBody and full request/respo… | |
| 10 | Obfuscation | high | js/background.js (line 1) | The entire background.js (~1.4MB) uses pervasive variable-name obfuscation replacing all identifiers with 2-3 character names (PJ, qn, wZ, jg, Fv, jd, yQ, Zt, ez, xR, lk) throughout the bundle. This level of obfuscati… | |
| 11 | Privilege Escalation | high | js/background.js (line 1) | The extension replaces window.eval and window.Function on web pages with custom wrapper functions that intercept all eval calls and dynamic function construction in page context. These wrappers execute in the page con… | |
| 12 | Privilege Escalation | high | js/background.js (line 1) | On first install, the background script immediately queries all open tabs and programmatically injects the content script into every tab across all frames. This bulk injection into pre-existing browsing sessions gives… | |
| 13 | Remote Code Loading | high | js/background.js (line 95701) | The extension uses the powerful 'scripting' permission to inject arbitrary JavaScript strings into the 'MAIN' world of any webpage. While this is used for ad-blocking scriptlets, the generic nature of the injector (He… | |
| 14 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID client identifier stored in chrome.storage.local and sends it to Google Analytics (UA-212265261-1) as a pageview hit on every background page load. This tracks individual user… | |
| 15 | Tracking | high | js/background.js (line 1) | The extension generates or retrieves a persistent client ID (CID) stored in chrome.storage.local, then sends pageview hits to Google Analytics (UA-212265261-1) via the Measurement Protocol. This constitutes covert use… | |
| 16 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID via the `uuid` library, stores it in `chrome.storage.local` under the key `cid`, and immediately sends a Google Analytics Measurement Protocol beacon to `https://www.google-an… | |
| 17 | Tracking | high | js/background.js (line 1) | The main entry point of the bundle calls the analytics module with hardcoded Google Analytics tracking ID `UA-212265261-1` as its final initialization step. This ID is not associated with AdGuard (whose code is forked… | |
| 18 | Unauthorized Data Collection | high | js/content.js (line 1) | The content script reads document.cookie extensively across all page contexts, including a polling function (listenCookieChange with 1-second default interval) that continuously monitors for cookie changes. It also mo… | |
| 19 | Unauthorized Data Collection | high | js/background.js (line 1) | A second distinct persistent client ID is generated using random alphanumeric characters plus a timestamp-derived suffix, then saved to `localStorage` under the key `client-id`. This ID is separate from the GA `cid` U… | |
| 20 | Unauthorized Data Collection | high | js/content.js (line 1) | The content script instantiates a `CookieController` that monitors `document.cookie` changes via `setInterval`, then sends each observed cookie's name, value, and domain back to the background page via `chrome.runtime… | |
| 21 | Code Injection | medium | js/background.js (line 1) | The extension replaces window.eval and window.Function in injected page contexts with proxy wrappers that intercept and log all dynamic code execution. While ostensibly used for ad-blocker scriptlets, monkey-patching … | |
| 22 | Data Exfiltration | medium | js/background.js (line 1) | The `sendHitStats` function POSTs ad-blocking rule hit statistics to `reports.adguard.com/rulestats.html`, including the browser type, extension version, and which filter lists and rule versions fired. Although rule-h… | |
| 23 | Network Interception | medium | js/content.js (line 1) | The content script intercepts window.postMessage events by overriding the native postMessage and addEventListener, listening for messages with an 'from-page-script@adguard' direction marker and relaying them to the ex… | |
| 24 | Obfuscation | medium | js/popup.js (line 1) | The entire popup.js is a single-line Browserify bundle with aggressive variable name obfuscation replacing all identifiers with 1-2 character names. While Browserify bundles are common, the complete replacement of all… | |
| 25 | Obfuscation | medium | js/popup.js (line 1) | The entire popup.js is a single-line bundle using uniformly mangled two-character variable names (yp, ut, Mh, Ai, Lp, DT, NU) applied to all user-defined logic — not just third-party dependencies. This level of identi… | |
| 26 | Privilege Escalation | medium | js/background.js (line 1) | On first install, the background script queries all currently open tabs and immediately injects the content script (`js/content.js`) into every one with `allFrames: true`. This aggressive injection on install (before … | |
| 27 | Remote Code Loading | medium | js/background.js (line 1) | A hardcoded API key (4DDBE80A3DA94D819A00523252FB6380) authenticates requests to https://chrome.adtidy.org, and filter rules are fetched remotely from adtidy.org. This means the extension's blocking behavior is contro… | |
| 28 | Tracking | medium | js/background.js (line 97931) | The extension connects to a remote analytics service (api1.extinsight.com) to fetch dynamically defined URLs for installation, updates, and uninstallation. These URLs are then automatically opened in new tabs, allowin… | |
| 29 | Tracking | medium | js/background.js (line 97293) | The extension generates and persists a unique client ID in `chrome.storage.local`, then sends it to Google Analytics as a daily background pageview beacon. This is tracking behavior inside an ad blocker, and the ident… | |
| 30 | Tracking | medium | js/background.js (line 97923) | The extension downloads remote configuration from `api1.extinsight.com` keyed by the extension ID, caches it locally, and uses the response to open install/update pages and configure an uninstall URL. This gives a rem… | |
| 31 | Tracking | medium | js/popup.js (line 1) | The popup extracts the active tab's domain and continuously polls the background script every second (setInterval at 1000ms) for blocked-request statistics keyed to that domain. This creates a persistent behavioral mo… | |
| 32 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension sends filter hit statistics (which ad rules fired on which pages), browser type, and version to https://chrome.adtidy.org/rulestats.html via XHR POST. This data collection discloses user browsing pattern… | |
| 33 | Unauthorized Data Collection | medium | js/background.js (line 1) | URL hash prefixes of every page visited are sent to https://sb.adtidy.org/safebrowsing-lookup-short-hash.html. While framed as a security feature, this enables the AdTidy server to track URL access patterns for all br… | |
| 34 | Unauthorized Data Collection | medium | js/content.js (line 1) | The content script establishes a bidirectional postMessage bridge between injected page scripts and the extension using wildcard origin ('*'), transmitting element URLs and the full document.URL on every message. Usin… | |
| 35 | Unauthorized Data Collection | medium | js/background.js (line 1) | The `getExtensionParams()` function assembles a query string containing the persistent `client-id`, the app version, the browser locale (`lang`), and the extension install ID, and appends this fingerprint to every req… | |
| 36 | Tracking | low | js/background.js (line 97285) | The extension explicitly whitelists Google Analytics for its own background script and sends background telemetry (pageviews) to its own UA-212265261-1 account. This bypasses its own ad-blocking logic to ensure tracki… | |
