TZWebChartWindow

Every URL visited on any of the six monitored tradezone.com.br subdomains is serialised and forwarded verbatim to a native host application ('com.tradezone.tzwebchartwindow') via sendNativeMessage. Native messaging bypasses all browser sandboxing, giving the host process unrestricted OS-level access to whatever data the extension passes — in this case the full navigation URL. This constitutes covert exfiltration of browsing activity to a locally-installed native binary whose behaviour cannot be inspected from the extension.

function loaded(o) {  console.log('loaded');  var ur = o.url.toString();  tid = o.tabId;  var hostName = "com.tradezone.tzwebchartwindow";  message = {    "text": ur  };  chrome.runtime.sendNativeMessage(hostName, message, function(response) {    if (chrome.runtime.lastError) {      if (chrome.runtime.lastError.message.indexOf('not found') > -1) {        instExtApp = "http://tzwebchartchrome.tradezone.com.br/publish.htm";        window.open(instExtApp, '_blank');        chrome.tabs.remove(tid);      } else        console.log("ERROR: " + chrome.runtime.lastError.message);    } else {      console.log("Messaging host sais: ", response);      chrome.tabs.remove(tid);    }  });

When the native host is absent the extension silently redirects the user to a plain HTTP (not HTTPS) URL — http://tzwebchartchrome.tradezone.com.br/publish.htm — in a new tab and then closes the original tab without user consent. Serving an install page over HTTP exposes the install flow to man-in-the-middle attacks. Forcibly closing tabs (chrome.tabs.remove) after the redirect further removes the user's ability to inspect or cancel what just happened.

chrome.runtime.sendNativeMessage(hostName, message, function(response) {  if (chrome.runtime.lastError) {    if (chrome.runtime.lastError.message.indexOf('not found') > -1) {      instExtApp = "http://tzwebchartchrome.tradezone.com.br/publish.htm";      window.open(instExtApp, '_blank');      chrome.tabs.remove(tid);    }  } else {    chrome.tabs.remove(tid);  }});

The extension intercepts completed navigation events on six financial-services subdomains (all under tradezone.com.br, which appears to be a Brazilian online brokerage / trading platform). Targeting multiple financial subdomains — including subdomains named after Brazilian brokers such as 'rico', 'easynvest', and 'xpi' — with automatic URL capture and native-message forwarding strongly indicates the purpose is to monitor users' trading activity or sessions on these financial sites.

chrome.webNavigation.onCompleted.addListener(loaded, {  url: [{      hostContains: 'tav.tradezone.com.br'    },    {      hostContains: 'rico.tradezone.com.br'    },    {      hostContains: 'clear.tradezone.com.br'    },    {      hostContains: 'xpi.tradezone.com.br'    },    {      hostContains: 'easynvest.tradezone.com.br'    },    {      hostContains: 'webchart.tradezone.com.br'    }  ]});

The variable 'message' is assigned without a preceding 'var', 'let', or 'const' declaration, making it an implicit global. While not inherently malicious, this is a code-quality red flag common in quickly-written or obfuscated code, and the implicit global could be read or overwritten by other scripts running in the extension context.

var hostName = "com.tradezone.tzwebchartwindow";message = {  "text": ur};chrome.runtime.sendNativeMessage(hostName, message, function(response) {