| 1 | Data Exfiltration | critical | js/backgroundscript.js (line 210) | The extension exfiltrates the user's full search query string (`SearchQuery`) along with the search engine hostname, number of pages visited, and current URL status to `https://flow.lavasoft.com/v1/event-stat?`. This … | |
| 2 | Data Exfiltration | critical | js/functionUtil.js (line 126) | A persistent WebSocket connection is opened to `wss://bsa.adaware.com` and torrent metadata (including infoHash values, which uniquely identify content) is streamed to Adaware's server. For Pro users, the license key … | |
| 3 | Privilege Escalation | critical | js/backgroundscript.js (line 157) | The background script exposes a generic permission-request relay that accepts an arbitrary `permissions` array from any content script or page via `chrome.runtime.onMessage`. This allows any web page that can communic… | |
| 4 | Unauthorized Data Collection | critical | js/backgroundscript.js (line 53) | On every page load across ALL websites (matched by `*://*/*`), the extension fetches each search-result URL in the background and forwards the full HTML to the content script for DOM scraping. This runs unconditionall… | |
| 5 | Data Exfiltration | high | js/functionUtil.js (line 138) | The extension establishes a persistent WebSocket connection to `wss://bsa.adaware.com` and transmits the user's license key in plaintext along with torrent infoHash values and tracker announce URLs for every torrent t… | |
| 6 | Privilege Escalation | high | js/popup.js (line 780) | The extension actively solicits the `nativeMessaging` permission at runtime via a 'Sync Now' UI banner presented to users. Native messaging allows the extension to communicate with native executables installed on the … | |
| 7 | Tracking | high | js/config.js (line 1) | The config object defines a telemetry endpoint at `https://flow.lavasoft.com/v1/event-stat?` operated by Lavasoft (a known adware/PUP vendor). It collects affiliate tracking parameters (PartnerID, CampaignID, CLID, Of… | |
| 8 | Tracking | high | js/popup.js (line 1446) | After torrent results are displayed, the popup explicitly extracts the user's Google search query (via the `q` URL parameter) and transmits it along with the current URL, hostname, and torrent count to the background … | |
| 9 | Tracking | high | js/telemetry.js (line 16) | On installation, the extension gathers and transmits a combined payload of browser environment data, install timestamp, a unique install identifier, and external affiliate/campaign data (PartnerID, CampaignID, CLID, O… | |
| 10 | Tracking | high | js/telemetry.js (line 34) | The extension sends a recurring daily activity beacon bundling browser fingerprint, install date, unique install ID, partner data, and license status to the Lavasoft remote endpoint. This persistent daily ping builds … | |
| 11 | Tracking | high | js/trackingDataUtil.js (line 82) | When the extension is uninstalled, it sets a custom uninstall URL appended with extensive tracking parameters including install date, unique install ID, PartnerID, CampaignID, CLID (click ID), OfferID, and extensionID… | |
| 12 | Tracking | high | js/start.js (line 99) | On first install, the extension reads the full URL of the Chrome Web Store tab — including query parameters — to extract affiliate/partner tracking identifiers (PartnerID, CampaignID, CLID, OfferID, sourceTraffic) and… | |
| 13 | Tracking | high | js/telemetry.js (line 76) | A comprehensive telemetry pipeline posts structured JSON to `https://flow.lavasoft.com/v1/event-stat?` on install, update, daily activity, UI actions, license events, and uninstall. Each payload includes a persistent … | |
| 14 | Tracking | high | js/trackingDataUtil.js (line 82) | On install, `chrome.runtime.setUninstallURL` is called with `https://www.torrentscanner.co/uninstall/?` appended with full affiliate attribution data (InstallId, PartnerID, CampaignID, CLID, OfferID, extensionID, sour… | |
| 15 | Unauthorized Data Collection | high | js/backgroundscript.js (line 210) | The extension transmits detailed user behavioral data to the Lavasoft telemetry endpoint including every search query entered (SearchQuery, QueryInput), the search engine used, the number of sites visited, and click c… | |
| 16 | Unauthorized Data Collection | high | js/backgroundscript.js (line 53) | The background service worker silently fetches the full HTML content of arbitrary third-party URLs extracted from the user's search engine results page and forwards it to the active content script. This constitutes un… | |
| 17 | Unauthorized Data Collection | high | js/telemetry.js (line 76) | The telemetry module POSTs detailed event payloads to `flow.lavasoft.com`, with each event bundling browser fingerprint data (browser name/version/locale, OS, extension version), a unique install ID, install date, and… | |
| 18 | Unauthorized Data Collection | high | js/start.js (line 188) | On every install, the extension silently probes two localhost ports (`38565` and `19575`) — the known GUI ports of BitTorrent Web Pro and uTorrent Web Pro — to detect locally installed applications. This constitutes u… | |
| 19 | Unauthorized Data Collection | high | js/start.js (line 108) | At install time, the extension reads the Chrome Web Store tab URL (including all query parameters) to silently extract affiliate tracking data and auto-activate a license key embedded in the `l=` URL parameter. This a… | |
| 20 | Unauthorized Data Collection | high | js/contentscript.js (line 14) | The content script, injected at `document_start` on every HTTP/HTTPS URL, scrapes all result links from Google, Bing, Yahoo, and Yandex search pages by querying known CSS selectors. The extracted URLs and the full cur… | |
| 21 | Data Exfiltration | medium | js/licenseUtil.js (line 4) | The extension transmits the user's license key along with a unique device identifier (installId) to the adaware.com license activation API. The license key is sent in cleartext JSON, and its pairing with the unique in… | |
| 22 | Data Exfiltration | medium | js/licenseUtil.js (line 114) | The license key is appended as a plain query parameter in the URL when checking license status at `bsa.adaware.com`. Embedding secrets in URL query strings is insecure as they appear in server logs, browser history, a… | |
| 23 | Tracking | medium | js/start.js (line 23) | The extension sends a daily activity beacon to Lavasoft's servers every 24 hours, reporting the last activity timestamp and the user's license status (Free vs. Pro). This persistent daily ping allows the operator to t… | |
| 24 | Tracking | medium | js/contentscript.js (line 14) | The content script scrapes all hyperlink URLs from search engine result pages (Google, Bing, Yahoo, Yandex) by querying specific DOM selectors, packages them together with the current page URL and search engine identi… | |
| 25 | Tracking | medium | js/licenseUtil.js (line 21) | License activation sends the user's `installId` (persistent UUID) and license key to `https://my.adaware.com/api/v1/license/activate`, which binds the device's unique install identity to the license key in Adaware's b… | |
| 26 | Unauthorized Data Collection | medium | js/start.js (line 188) | The extension probes the user's localhost on ports 38565 and 19575 to detect whether BitTorrent Web Pro or uTorrent Web Pro is running locally. Scanning localhost ports from a browser extension constitutes unauthorize… | |
| 27 | Unauthorized Data Collection | medium | js/systemUtil.js (line 9) | This function systematically collects browser fingerprinting data (browser name, version, locale, OS platform, extension version/locale) bundled into every telemetry event transmitted to the Lavasoft remote server. Co… | |
| 28 | Other | low | js/start.js (line 250) | On extension update, `chrome.runtime.reload()` is invoked after a 6-second delay. This forces the service worker to restart unconditionally on every update without user action, ensuring new code starts running immedia… | |
