| 1 | Code Injection | critical | js/content.js (line 1) | The content script dynamically creates and injects script elements into page DOM in response to an 'injectScripts' runtime message, executing arbitrary JavaScript received from the background page without any content … | |
| 2 | Credential Theft | critical | js/content.js (line 1) | The content script reads cookie names and their full values from every visited page and transmits them to the background page via SAVE_COOKIE_LOG_EVENT messages including cookieName, cookieValue, and cookieDomain fiel… | |
| 3 | Network Interception | critical | js/background.js (line 1) | The injected script replaces the global fetch function with a Proxy that intercepts every fetch call made by the page, inspects all request arguments (URL, headers, body), and can selectively block requests or allow t… | |
| 4 | Obfuscation | critical | js/background.js (line 1) | This function implements a custom multi-step deobfuscation algorithm: it splits and interleaves characters from two halves of an encoded string, applies XOR operations on adjacent digit pairs, then base64-decodes the … | |
| 5 | Privilege Escalation | critical | js/background.js (line 3) | On extension install, the background script immediately queries ALL open browser tabs and programmatically injects js/content.js into every tab and every frame without user interaction. This gives the extension immedi… | |
| 6 | Privilege Escalation | critical | js/content.js (line 1) | The extension intercepts property access on iframe contentWindow and contentDocument objects by overriding their property descriptor getters, then calls eval() directly on each iframe's window object to inject extensi… | |
| 7 | Unauthorized Data Collection | critical | js/background.js (line 1) | The extension generates and permanently stores a unique UUID as 'cid' in chrome.storage.local, then on every background script startup fires a Google Analytics 'pageview' beacon to https://www.google-analytics.com/col… | |
| 8 | Credential Theft | high | js/background.js (line 1) | This function enumerates all cookies on visited pages via document.cookie.split, matches them against a regex pattern supplied at call time, then forcibly deletes matching cookies by setting them expired across all do… | |
| 9 | Obfuscation | high | js/content.js (line 1) | The entire content.js file (92KB) is a single-line minified bundle with systematically obfuscated variable names using randomized two-letter uppercase identifiers (AX, WL, SO, uC, LQ, T, jm, V) applied consistently th… | |
| 10 | Other | high | js/background.js (line 52790) | The extension silently downloads an external whitelist and merges it into its local allowlist at runtime. Because the source is plain HTTP, anyone in a position to tamper with network traffic could alter which domains… | |
| 11 | Tracking | high | js/background.js (line 1) | The extension generates and persists a unique client ID (UUID) in chrome.storage.local, then sends a Google Analytics pageview hit to UA-212393691-1 containing the extension's runtime ID and the persistent CID on ever… | |
| 12 | Tracking | high | js/background.js (line 1) | The sendHitStats function sends filter rule hit statistics (encoded rule matches, browser type, extension version, and filter IDs) via POST to https://chrome.adtidy.org/rulestats.html, with a hardcoded API key appende… | |
| 13 | Tracking | high | js/background.js (line 1) | The extension transmits short URL hash prefixes to https://sb.adtidy.org/safebrowsing-lookup-short-hash.html for each page visited, as part of a safe browsing check. Even as hashed prefixes, this reveals a fingerprint… | |
| 14 | Unauthorized Data Collection | high | js/background.js (line 1) | The injected script replaces window.eval and window.Function with hooked wrappers that intercept and log all dynamic code execution calls on every visited page, forwarding them to an internal callback (WL). This monke… | |
| 15 | Unauthorized Data Collection | high | js/content.js (line 1) | A setInterval polling loop runs every 1000ms to continuously monitor document.cookie for changes on every visited page. When any cookie changes, the applyRule callback is triggered and passes the full cookie name and … | |
| 16 | Code Injection | medium | js/content.js (line 686) | The content script uses `eval` to inject code into each frame's page context and hooks `contentWindow`/`contentDocument` accessors so the injection happens automatically. This is a powerful code-injection primitive th… | |
| 17 | Code Injection | medium | js/content.js (line 1) | The content script dynamically executes code inside iframes via SO.eval(), injecting a self-invoking function with parameters into the iframe's execution context. While this appears to be part of AdGuard's frame-injec… | |
| 18 | Data Exfiltration | medium | js/background.js (line 1) | The extension exfiltrates detailed filter-hit statistics — including the extension version, browser type, and per-filter IDs and versions — via XHR POST to a remote ruleStatsUrl endpoint. Combined with the persistent … | |
| 19 | Network Interception | medium | js/background.js (line 48427) | This handler intercepts outgoing `Cookie` headers and incoming `Set-Cookie` headers, parses them, and stores the parsed cookie data in request context state. That gives the extension visibility into session cookies fo… | |
| 20 | Other | medium | js/background.js (line 1) | A hardcoded API key (4DDBE80A3DA94D819A00523252FB6380) is embedded directly in the extension source and appended to all outbound requests to chrome.adtidy.org. This key authenticates the extension to AdTidy's backend … | |
| 21 | Privilege Escalation | medium | js/content.js (line 1) | The postMessage call uses the wildcard "*" as the targetOrigin parameter when dispatching messages containing request metadata (elementUrl, documentUrl, requestType, requestId) from the injected page-script bridge. Us… | |
| 22 | Tracking | medium | js/background.js (line 52750) | This code generates and persists a unique client ID, then sends telemetry to Google Analytics from the background page. For a privacy/security extension, persistent third-party analytics is a notable tracking pattern … | |
