Security Alert: Confirmed Malware
This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Ad-Block, for Twitch
CRITICAL RISKRemoved from Chrome Web Store
Video Ad-Block, for Twitch
ID: kgeglempfkhalebjlogemlmeakondflc
Could be malicious
Supported Languages
🇺🇸English
Extension Info & Metadata
Status
Removed
Version
5.3.4
Size
0.04 MB
Rating
4.5/5
Reviews
532
Users
600,000
Type
Extension
Updated
Mar 29, 2022
Category
11_web-development
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Publisher Contextual Analysis
- Author
- sauceView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Total Extensions
3
Active
0
Obsolete
3
Listed
3
Unlisted
0
Total Users
600,664
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Swaps video ads for an ad-free stream.
YOU MUST DISABLE TTV LOL / PURPLE ADBLOCK FOR THIS EXTENSION TO WORK. This video adblock for Twitch extension will swap Twitch video ads for an ad-free version of the stream at 480p and then automatically switch back to the original video quality once the ad is finished. This is all done locally, no proxies, no VPN's and no third party websites. The extension does not collect nor share any personal information and is opensource, link is below. Works best when used with UBlock Origin, although this extension does also block some ad tracking URL's. If you would like to support the dev/author, you can via the Paypalme link: https://paypal.me/ttvadblock Or you can contribute via crypto: https://commerce.coinbase.com/checkout/f289396a-e426-4b23-8daf-1ca9887fe2be You MUST remove any other previous Twitch specific ad blockers or user-scripts in case of conflicts. For example, TTV LoL and Purple Ad-Block will override this extension and stop it from working. However this extension can be used with uBlock Origin (Without user-scripts installed). If you have issues while using this extension, please note, some ad-blocker extensions may interfere with this extension. The extension code is opensource and can be looked at here: https://github.com/saucettv/VideoAdBlockForTwitch Permissions: We ask for the Twitch URL permission so that we can put the content script into the page and block the ads. We also block ad trackers and ad serving script URL's. DISCLAIMER OF LIABILITY: The author of this extension specifically DISCLAIMS LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES and assumes no responsibility or liability for any loss or damage suffered by any person, company, corporation, service or subsidiary as a result of the use or misuse of the browser extension. The author assumes or undertakes NO LIABILITY for any loss or damage suffered as a result of the use, misuse or reliance on the browser extension. By using the browser extension you, the user accept full responsibility for any loss, damage or harm that may be caused by your use of the browser extension.
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical1
High112
Medium106
Low20
Versions scanned
Showing 30 of 37 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 5.3.3 | 7 |
| 5.3.2 | 9 |
| 5.3.1 | 9 |
| 5.2.7 | 8 |
| 5.2.6 | 4 |
| 5.2.5 | 7 |
| 5.2.3 | 9 |
| 5.2.2 | 7 |
| 5.2.1 | 8 |
| 5.2.0 | 8 |
| 5.1.2 | 8 |
| 5.1.1 | 8 |
| 5.1.0 | 9 |
| 5.0.4 | 9 |
| 5.0.1 | 8 |
| 5.0.0 | 6 |
| 4.9.5 | 9 |
| 4.9.4 | 9 |
| 4.9.3 | 8 |
| 4.9.1 | 9 |
| 4.9 | 9 |
| 4.8 | 9 |
| 4.6 | 8 |
| 4.5 | 7 |
| 4.4 | 7 |
| 4.3 | 9 |
| 4.2 | 7 |
| 4.1 | 9 |
| 4.0 | 8 |
| 2.0 | 7 |
Files with findings
1 distinct path — top paths by unique finding count:
- content.js239
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Code Injection | critical | content.js (line 357) | The extension bypasses Chrome's content script isolation sandbox by serializing its entire logic into a string, creating a <script> DOM element, and injecting it directly into the page. Running at document_start (mani… | |
| 2 | Code Injection | high | content.js (line 825) | Content script injects a large inline <script> element into the page's main world by stringifying the entire removeVideoAds function and wrapping it in an IIFE. This bypasses content-script isolation so the injected c… | |
| 3 | Code Injection | high | content.js (line 824) | The content script serializes the entire `removeVideoAds` function (>700 lines including fetch hooks, Worker overrides, and credential capture) into a string and injects it into the page's main world via an inline <sc… | |
| 4 | Code Injection | high | content.js (line 792) | Injects the entire `removeVideoAds` function (which contains all the page-context hooking/spoofing logic) into the page DOM as a `<script>` element via `createTextNode`. This is a classic content-script-isolation bypa… | |
| 5 | Code Injection | high | content.js (line 112) | Overrides the global `Worker` constructor and substitutes Twitch's real worker with a custom Blob-URL worker built from stringified functions (`.toString()`) plus `importScripts(jsURL)` of the original. This is a work… | |
| 6 | Code Injection | high | content.js (line 112) | The extension replaces the page's native `Worker` constructor and rebuilds Twitch's worker script by injecting its own functions into a new Blob-backed worker. This is a strong code-injection pattern because it tamper… | |
| 7 | Code Injection | high | content.js (line 793) | Injects a large block of JavaScript directly into the page's DOM context by serializing the entire removeVideoAds function to a <script> tag's textContent. This escapes the content-script isolated world, executes with… | |
| 8 | Code Injection | high | content.js (line 792) | The content script serializes a large function (`removeVideoAds`) into an inline <script> tag and appends it to the page DOM. This executes the entire ad-blocking payload in the page's main JS world (not the isolated … | |
| 9 | Code Injection | high | content.js (line 112) | The extension overrides the global `window.Worker` constructor and replaces every Worker the page tries to spawn with a Blob-URL worker that imports the original script via `importScripts` and prepends attacker-contro… | |
| 10 | Code Injection | high | content.js (line 783) | The content script serializes the entire `removeVideoAds` function via `.toString()` and injects it into the page DOM as an inline <script> element, executing it in the page (MAIN) world rather than the isolated conte… | |
| 11 | Code Injection | high | content.js (line 744) | The content script stringifies a large function (`removeVideoAds`) and injects it into the page's main world via a dynamically created <script> element. This is a deliberate isolation-bypass / privilege-escalation pat… | |
| 12 | Code Injection | high | content.js (line 108) | Replaces the global `Worker` constructor with a subclass that synthesizes new worker source by concatenating stringified functions into a Blob and instantiating the worker from a `blob:` URL. This is dynamic code gene… | |
| 13 | Code Injection | high | content.js (line 108) | Replaces the global Worker constructor so that whenever Twitch instantiates a Web Worker, the extension synthesises a Blob URL containing its own JavaScript and then loads Twitch's original worker via importScripts. T… | |
| 14 | Code Injection | high | content.js (line 674) | The content script stringifies the entire `removeVideoAds` function and injects it into the page's DOM as an inline <script> element. This is a classic page-context code injection technique used to escape the isolated… | |
| 15 | Code Injection | high | content.js (line 673) | The content script serializes the entire `removeVideoAds` function via `.toString()` and injects it into the page DOM as an inline <script> element. This is a classic content-script-to-page-context code injection patt… | |
| 16 | Code Injection | high | content.js (line 673) | The extension serializes the entire `removeVideoAds` function via `.toString()` and injects it as an inline `<script>` element into the live Twitch page DOM. This is classic content-script-to-page-context code injecti… | |
| 17 | Code Injection | high | content.js (line 644) | The content script serializes a large function (`removeVideoAds`) to a string and injects it into the page's DOM as an inline <script> tag, escaping the content script sandbox to execute arbitrary JavaScript in the pa… | |
| 18 | Code Injection | high | content.js (line 101) | The injected page script monkey-patches the global `Worker` constructor so that every Web Worker Twitch creates is replaced with a worker built from a generated Blob URL that wraps Twitch's original code with custom l… | |
| 19 | Code Injection | high | content.js (line 643) | Injects a page-context script by stringifying the entire `removeVideoAds` function and appending it as inline JavaScript via createElement('script') + textContent. This bypasses the content-script isolated world so th… | |
| 20 | Code Injection | high | content.js (line 103) | Replaces the global `Worker` constructor and synthesizes a new Worker source by concatenating stringified function bodies into a Blob URL, then `importScripts()` of a URL parsed out of Twitch's original blob. This is … | |
| 21 | Code Injection | high | content.js (line 607) | Injects a large inline <script> element into the page DOM, executing the entire `removeVideoAds` function in the page's main world (outside the isolated content-script sandbox). This pattern bypasses Chrome's content-… | |
| 22 | Code Injection | high | content.js (line 125) | Overrides the global Worker constructor and constructs a synthetic Worker by serializing function source via `.toString()` into a Blob URL, then `importScripts()` the original Twitch worker URL. Hooking the Worker con… | |
| 23 | Code Injection | high | content.js (line 137) | Hijacks the global Worker constructor and replaces Twitch's worker with one built from a dynamically-assembled Blob URL containing serialized function source plus an external `importScripts(jsURL)`. This is a remote/d… | |
| 24 | Code Injection | high | content.js (line 591) | Injects a large inline <script> into the page's DOM by serializing the entire removeVideoAds function and inserting it via createTextNode. This breaks the content-script isolated world and runs attacker-controlled cod… | |
| 25 | Code Injection | high | content.js (line 622) | The content script serializes a large function (`removeVideoAds`) to a string and injects it as an inline <script> element into the page's main world. This deliberately escapes the extension's isolated world to run pr… | |
| 26 | Code Injection | high | content.js (line 126) | Replaces the global Worker constructor so that whenever Twitch creates its main player worker, the extension instead spawns a Worker whose body is a synthesized blob containing extension-defined functions plus an `imp… | |
| 27 | Code Injection | high | content.js (line 622) | Content script injects a dynamically-created <script> element into the page DOM to execute the entire removeVideoAds function in the page's main world (not the isolated content-script context). This bypasses Chrome's … | |
| 28 | Code Injection | high | content.js (line 667) | Content script serializes a large function (removeVideoAds) and injects it into the host page via a <script> tag with createTextNode. This effectively runs ~600 lines of privileged-looking code in the Twitch page's ma… | |
| 29 | Code Injection | high | content.js (line 114) | Overrides the global Worker constructor to wrap Twitch's video worker. It builds a new Blob worker that concatenates extension functions as strings and then `importScripts(jsURL)` to load the original worker code. Thi… | |
| 30 | Code Injection | high | content.js (line 613) | The content script serializes the entire `removeVideoAds` function via `toString` and injects it into the page DOM as an inline <script> element to execute in the page's main world. This is a classic code-injection te… | |
| 31 | Code Injection | high | content.js (line 21) | The extension completely replaces window.Worker to intercept Twitch's web worker instantiation. It reads the original worker's source URL via a synchronous XHR, prepends its own serialized functions into the worker bl… | |
| 32 | Credential Theft | high | content.js (line 721) | Monkey-patches `window.fetch` to intercept every request to `/access_token` and `gql.twitch.tv`, harvesting the user's `X-Device-Id`, `Client-Version`, `Client-Session-Id`, and `Client-ID` headers and forwarding them … | |
| 33 | Credential Theft | high | content.js (line 690) | Hooks window.fetch in the page context to harvest Twitch's Client-ID, Client-Version, Client-Session-Id, and X-Device-Id headers from outgoing GraphQL/access_token calls, then forwards them to the in-extension worker … | |
| 34 | Credential Theft | high | content.js (line 563) | In the page main world, fetch is wrapped to sniff every Twitch request to /access_token and /gql, harvesting the user's Device-ID, Client-ID, and Client-Version request headers and forwarding them via postMessage to t… | |
| 35 | Network Interception | high | content.js (line 722) | Monkey-patches window.fetch to intercept every Twitch request and read sensitive identity headers (X-Device-Id, Device-ID, Client-Version, Client-Session-Id, Client-ID) plus mutate request bodies and URLs. The harvest… | |
| 36 | Network Interception | high | content.js (line 300) | Inside the hijacked Worker, fetch is overwritten to intercept Twitch HLS/video-weaver requests, read the original response body, and substitute a different Response constructed from a parallel fetch chain. The substit… | |
| 37 | Network Interception | high | content.js (line 523) | Uses the captured user identifiers to forge GraphQL `ClientSideAdEventHandling_RecordAdEvent` calls reporting fake ad impressions, quartile completions, and pod completions to Twitch — events the user never actually s… | |
| 38 | Network Interception | high | content.js (line 686) | This code monkey-patches `window.fetch`, inspects Twitch GraphQL and access-token requests, and extracts or rewrites `Device-ID`, `X-Device-Id`, `Client-Version`, `Client-Session-Id`, and `Client-ID` headers. Intercep… | |
| 39 | Network Interception | high | content.js (line 497) | This block actually submits forged `video_ad_impression`, quartile-completion, and pod-completion GraphQL events to Twitch. Combined with the captured device and session headers elsewhere in the file, it constitutes a… | |
| 40 | Network Interception | high | content.js (line 221) | Replaces the global fetch in the worker context to intercept and silently rewrite Twitch's video-weaver and HLS playlist responses, substituting attacker-fetched content for the real network response. While intended f… | |
| 41 | Network Interception | high | content.js (line 221) | Inside the hijacked worker the extension monkey-patches the global `fetch`, intercepts Twitch HLS / video-weaver requests, and substitutes its own Response objects (replacing the m3u8 playlist with one fetched under a… | |
| 42 | Network Interception | high | content.js (line 689) | In the page world the extension hooks `window.fetch`, reads sensitive request headers (Client-ID, Client-Version, Client-Session-Id, Device-ID) out of every Twitch GQL/access_token request and forwards them to its wor… | |
| 43 | Network Interception | high | content.js (line 680) | Overrides `window.fetch` to inspect every Twitch request and harvest authentication-relevant headers (Client-ID, Client-Version, Client-Session-Id, Device-ID/X-Device-Id) plus a localStorage device identifier, then fo… | |
| 44 | Network Interception | high | content.js (line 215) | Monkey-patches the worker's global `fetch` to intercept Twitch video-weaver and HLS playlist requests, substituting alternate responses fetched out-of-band. This is network-interception — modifying the response body t… | |
| 45 | Network Interception | high | content.js (line 668) | Hooks `window.fetch` in the page context to read sensitive Twitch headers (Device-ID, Client-ID, Client-Version) off outgoing requests and forwards them to the synthesized worker via postMessage. It also rewrites outg… | |
| 46 | Network Interception | high | content.js (line 610) | `window.fetch` is monkey-patched on twitch.tv to inspect every request to `/access_token` and `gql` endpoints and harvest the `X-Device-Id`, `Client-Version`, and `Client-ID` headers, which it then forwards via postMe… | |
| 47 | Network Interception | high | content.js (line 214) | Inside the rewritten Worker, `fetch` is also patched to intercept Twitch's `video-weaver` and HLS playlist requests, read the response body, and substitute it with a different m3u8 fetched from upstream. This is in-fl… | |
| 48 | Network Interception | high | content.js (line 214) | Inside the injected worker, the global `fetch` is replaced so that requests to Twitch's `video-weaver` and `/api/channel/hls/` endpoints are intercepted, their responses substituted with attacker-controlled m3u8 playl… | |
| 49 | Network Interception | high | content.js (line 610) | The page-context fetch hook reads `X-Device-Id`, `Device-ID`, `Client-ID`, and `Client-Version` headers out of every Twitch GQL/access-token request and forwards them to the extension's worker, then mutates outgoing G… | |
| 50 | Network Interception | high | content.js (line 207) | The extension overrides the global `fetch` inside Twitch's Worker to intercept video-weaver and HLS playlist requests, rewrite the response body, and substitute a different m3u8 stream than the one Twitch served. This… | |
| 51 | Network Interception | high | content.js (line 448) | The extension reuses the harvested `Client-ID`, `Device-ID`, and `Client-Version` from the user's own Twitch session to issue background GraphQL requests to gql.twitch.tv impersonating the Twitch web client. This auth… | |
| 52 | Network Interception | high | content.js (line 580) | Globally overrides window.fetch to inspect every Twitch GraphQL/access-token request, harvest the user's Device-ID, Client-ID, and Client-Version from headers, and forward them to a Worker context. The hook also condi… | |
| 53 | Network Interception | high | content.js (line 207) | Inside the synthesized Worker, fetch is replaced to intercept Twitch video-weaver/HLS responses, replace the response body with a swapped-stream m3u8 it fetched out-of-band, and silently substitute media URLs. Classic… | |
| 54 | Network Interception | high | content.js (line 229) | Inside the hijacked worker, fetch is overridden so that responses for Twitch video-weaver M3U8 playlists are intercepted, parsed, and rewritten before being returned to the player. Network interception of streaming UR… | |
| 55 | Network Interception | high | content.js (line 226) | Monkey-patches the global `fetch` inside the Twitch player worker to intercept video-weaver and HLS playlist requests, read the response body, and substitute a different response (a different m3u8 stream). Network int… | |
| 56 | Network Interception | high | content.js (line 560) | Hooks page-level fetch to read the user's Twitch `X-Device-Id` / `Device-ID` / `Client-Version` request headers out of every Twitch API call, stores them, and forwards them to the worker for reuse. It also mutates out… | |
| 57 | Network Interception | high | content.js (line 222) | Monkey-patches the global `fetch` inside the worker to intercept Twitch HLS m3u8 (`video-weaver`) responses, rewrite their content, and return forged Response objects to the player. Network interception/response rewri… | |
| 58 | Network Interception | high | content.js (line 222) | Replaces the worker's global fetch with a wrapper that intercepts video-weaver and HLS access_token requests, rewrites their responses, and returns synthesized Response objects to the caller. Network interception of t… | |
| 59 | Network Interception | high | content.js (line 124) | The extension monkey-patches the global Worker constructor and replaces every Worker Twitch tries to spawn with a Blob-URL Worker that wraps Twitch's real wasm worker (loaded via importScripts of a URL extracted from … | |
| 60 | Network Interception | high | content.js (line 222) | Inside the injected worker, `fetch` is replaced with a wrapper that inspects every URL, captures Twitch HLS channel parameters into worker globals, and rewrites video-weaver responses with attacker-controlled m3u8 con… | |
| 61 | Network Interception | high | content.js (line 222) | Monkey-patches the global `fetch` inside the worker to intercept, inspect, and rewrite responses for Twitch's HLS/m3u8 endpoints. Even though the stated intent is ad removal, this is a generic network-interception pri… | |
| 62 | Network Interception | high | content.js (line 222) | Monkey-patches the worker's global fetch() to intercept and rewrite Twitch video-weaver and HLS access-token requests, returning fabricated Response objects to the player. This is full network-request interception (fu… | |
| 63 | Network Interception | high | content.js (line 409) | The extension overrides the global fetch inside the Twitch worker to intercept video-weaver m3u8 responses, replace their bodies with attacker-chosen text (a different m3u8 fetched from another endpoint), and resolve … | |
| 64 | Network Interception | high | content.js (line 638) | Monkey-patches window.fetch on twitch.tv to inspect every request matching /access_token or gql, harvest the user's X-Device-Id / Device-ID header, and forward it to the injected Worker. It also rewrites outgoing requ… | |
| 65 | Network Interception | high | content.js (line 116) | Globally monkey-patches the page's `Worker` constructor and `fetch` (both in the page main thread and inside the spawned worker) to intercept and rewrite network requests/responses for Twitch APIs (`/access_token`, `g… | |
| 66 | Network Interception | high | content.js (line 204) | Inside the injected worker, fetch is replaced wholesale to intercept M3U8 video-segment playlist responses from video-weaver CDN endpoints before they reach the Twitch player. The intercepted response body is read in … | |
| 67 | Other | high | content.js (line 523) | Forges fake ad-engagement telemetry (impression, quartile completes, pod_complete) and submits it to Twitch's GraphQL endpoint using the user's stolen ClientID/DeviceID/SessionID and the harvested radToken. This silen… | |
| 68 | Other | high | content.js (line 465) | The extension parses Twitch ad metadata from playlist tags, extracts the RADS token and ad identifiers, and prepares synthetic ad-event payloads. This is suspicious because it is designed to forge ad telemetry and man… | |
| 69 | Other | high | content.js (line 466) | Constructs and sends forged GraphQL telemetry to Twitch (video_ad_impression, video_ad_quartile_complete, video_ad_pod_complete) using stolen client headers and the user's session, falsely reporting that ads were watc… | |
| 70 | Other | high | content.js (line 391) | Forges and submits Twitch GQL telemetry events (`video_ad_impression`, `video_ad_quartile_complete`, `video_ad_pod_complete`) impersonating the user's player to claim that ads were watched while the actual stream was … | |
| 71 | Other | high | content.js (line 390) | The extension forges Twitch GraphQL telemetry events (`video_ad_impression`, `video_ad_quartile_complete`, `video_ad_pod_complete`) using the harvested `radToken`, `lineItemId`, `orderId`, `creativeId`, and `adId` att… | |
| 72 | Other | high | content.js (line 383) | The extension forges Twitch ad-telemetry GraphQL events (`video_ad_impression`, `video_ad_quartile_complete`, `video_ad_pod_complete`) to make Twitch believe ads were watched even though they were swapped out. This is… | |
| 73 | Other | high | content.js (line 385) | Forges fraudulent ad-telemetry GraphQL events (`video_ad_impression`, `video_ad_quartile_complete`, `video_ad_pod_complete`) to Twitch using the harvested device/client IDs, falsely claiming the user viewed each ad's … | |
| 74 | Other | high | content.js (line 381) | Forges fake ad-impression, ad-quartile-complete, and ad-pod-complete GQL events back to Twitch using the user's own Device-ID / Client-Version, claiming ads were watched (muted, invisible) when they were never actuall… | |
| 75 | Other | high | content.js (line 377) | Forges Twitch GraphQL ad-telemetry events (`video_ad_impression`, `video_ad_quartile_complete`, `video_ad_pod_complete`) on the user's behalf, falsely reporting that ads were viewed/completed muted-and-invisible to re… | |
| 76 | Other | high | content.js (line 377) | Programmatically POSTs fabricated ad telemetry events (video_ad_impression, video_ad_quartile_complete, video_ad_pod_complete) to Twitch's GraphQL API claiming the user watched ads to completion, even though no ad was… | |
| 77 | Other | high | content.js (line 377) | The extension parses the ad RADS token out of Twitch's HLS playlist and POSTs forged `video_ad_pod_complete` GraphQL events back to gql.twitch.tv to make Twitch's ad backend believe the user watched ads (so it serves … | |
| 78 | Other | high | content.js (line 377) | Programmatically issues spoofed 'video_ad_pod_complete' GraphQL events to gql.twitch.tv using the user's hijacked device ID and a hardcoded persisted-query hash, falsely reporting that ads were watched (player_mute:tr… | |
| 79 | Other | high | content.js (line 364) | The extension fabricates and submits ad-impression, quartile-completion, and pod-complete GQL events to Twitch on the user's behalf without an ad ever playing, in order to reduce ad frequency. This is automated falsif… | |
| 80 | Other | high | content.js (line 363) | Fabricates and submits `video_ad_impression`, `video_ad_quartile_complete`, and `video_ad_pod_complete` GraphQL events to Twitch using the user's session, falsely reporting that ads were watched (player_mute:true, pla… | |
| 81 | Other | high | content.js (line 158) | When ad segments are detected, the extension programmatically fires video_ad_impression, four video_ad_quartile_complete events, and video_ad_pod_complete GQL mutations to Twitch's API for each ad in the pod — without… | |
| 82 | Privilege Escalation | high | content.js (line 465) | Forges fake `video_ad_impression`, `video_ad_quartile_complete`, and `video_ad_pod_complete` events to Twitch's GraphQL endpoint using the user's session, falsely claiming the ad was watched (muted, volume 0, not visi… | |
| 83 | Privilege Escalation | high | content.js (line 456) | Forges and sends GraphQL `ClientSideAdEventHandling_RecordAdEvent` mutations (impression, quartile completes, pod complete) to gql.twitch.tv using the harvested ClientID/Device-ID/Client-Session/Client-Version, falsel… | |
| 84 | Privilege Escalation | high | content.js (line 734) | The extension serializes its main `removeVideoAds` function to source text and injects it into the page DOM as an inline <script>. This escapes the content-script isolated world and executes the code in the page's mai… | |
| 85 | Privilege Escalation | high | content.js (line 467) | The worker forges Twitch GraphQL POST requests using the harvested user identifiers (Client-ID, Device-ID, Client-Version) to silently call PlaybackAccessToken_Template and ClientSideAdEventHandling_RecordAdEvent on t… | |
| 86 | Privilege Escalation | high | content.js (line 124) | Replaces the global Worker constructor with a subclass that synthesizes a new Blob worker, injects a custom fetch hook into it, and then importScripts() the original Twitch worker URL parsed out of the blob. This is a… | |
| 87 | Remote Code Loading | high | content.js (line 115) | Subclasses window.Worker to intercept the page's Web Worker construction, building a Blob URL containing dynamically assembled JavaScript and then importScripts() of a URL extracted from the original blob fetched via … | |
| 88 | Remote Code Loading | high | content.js (line 115) | Replaces the global `Worker` constructor with a wrapper that builds a new worker from a Blob URL containing dynamically concatenated function source code, then `importScripts()` a URL extracted from Twitch's original … | |
| 89 | Remote Code Loading | high | content.js (line 110) | Overrides the global Worker constructor so that Twitch's WebAssembly video worker is replaced by an attacker-controlled Blob worker. The new worker stringifies multiple functions, prepends them to the original JS via … | |
| 90 | Remote Code Loading | high | content.js (line 110) | Replaces the global Worker constructor to substitute Twitch's worker with a synthesized Blob worker that imports a remote script URL (parsed from the original Twitch blob via XHR) using `importScripts()`. Building exe… | |
| 91 | Remote Code Loading | high | content.js (line 208) | Synchronously fetches Twitch's blob-URL worker source, parses out an inner script URL, and later loads it via `importScripts('${jsURL}')` inside the synthesized worker. This is remote-code-loading: arbitrary JavaScrip… | |
| 92 | Remote Code Loading | high | content.js (line 108) | Overrides the global `Worker` constructor to swap Twitch's worker for a synthetic worker built from a dynamically generated Blob URL. The synthetic worker uses `importScripts('${jsURL}')` where `jsURL` is parsed from … | |
| 93 | Remote Code Loading | high | content.js (line 207) | Performs a synchronous XHR against a blob URL supplied by the page and naively parses out the first single-quoted substring as a script URL, which is then handed to `importScripts` inside the replacement worker. There… | |
| 94 | Remote Code Loading | high | content.js (line 108) | The page-injected code overrides the global `window.Worker` constructor and replaces every Web Worker spawned by Twitch with a Blob-URL worker built from concatenated function source. The new worker then `importScript… | |
| 95 | Remote Code Loading | high | content.js (line 110) | The extension monkey-patches the global `window.Worker` constructor and replaces every Twitch worker with a Blob-URL worker built from concatenated function source plus `importScripts(jsURL)` for a URL extracted from … | |
| 96 | Remote Code Loading | high | content.js (line 207) | Synchronous XHR fetches the original Twitch worker blob and regex-extracts a JS URL via string-splitting on quote characters, which is then passed to `importScripts()` inside the replacement worker. Synchronous networ… | |
| 97 | Remote Code Loading | high | content.js (line 103) | Overrides the global `Worker` constructor and replaces every Twitch Worker with a Blob-URL Worker built from concatenated function source plus an `importScripts()` of Twitch's original wasm-worker URL. This is dynamic… | |
| 98 | Remote Code Loading | high | content.js (line 125) | The extension subclasses window.Worker so that every Worker the page constructs is replaced with a Blob-URL worker built from concatenated function source plus importScripts() of a URL extracted from the original Twit… | |
| 99 | Remote Code Loading | high | content.js (line 219) | Synchronous XHR fetches the body of an arbitrary blob/URL passed to the Worker constructor and parses a quoted substring out of it. The extracted URL is then handed to `importScripts()` inside the rebuilt worker, effe… | |
| 100 | Remote Code Loading | high | content.js (line 126) | Overrides the global `Worker` constructor so any Web Worker Twitch tries to spawn is replaced with an attacker-controlled Blob worker assembled from stringified functions. The synthesized worker then `importScripts()`… | |
| 101 | Remote Code Loading | high | content.js (line 215) | Performs a synchronous XHR against a runtime-supplied blob URL, parses out an embedded JS URL by string splitting, and then feeds that URL into `importScripts()` inside a generated Blob worker (line 167). Treating arb… | |
| 102 | Remote Code Loading | high | content.js (line 124) | Replaces the global Worker constructor and substitutes the original Twitch worker script with a Blob URL constructed from stringified functions plus an importScripts() of the original. This is dynamic code generation/… | |
| 103 | Remote Code Loading | high | content.js (line 116) | The extension replaces window.Worker with a wrapper that constructs a fresh worker from a Blob URL whose body concatenates extension-defined functions and then importScripts() a URL parsed out of Twitch's own worker b… | |
| 104 | Remote Code Loading | high | content.js (line 117) | Subclasses the global Worker constructor and replaces every Worker the page tries to create with a Blob-URL Worker that first imports remotely-fetched JavaScript (jsURL is read from twitchBlobUrl via a synchronous XHR… | |
| 105 | Remote Code Loading | high | content.js (line 212) | Performs a synchronous XHR against the Twitch worker blob URL, parses out an embedded JS URL, and later passes it to `importScripts(...)` inside an extension-built worker. Synchronous remote fetching of code that is t… | |
| 106 | Remote Code Loading | high | content.js (line 127) | Overrides `window.Worker` and constructs a new Worker from a Blob URL whose body is built by concatenating function source as strings, then `importScripts` of a URL extracted from a remote blob. This is functionally e… | |
| 107 | Unauthorized Data Collection | high | content.js (line 606) | Issues authenticated GraphQL POSTs to gql.twitch.tv impersonating the legitimate Twitch web client by replaying the user's harvested Client-ID, Device-ID, Client-Version and Client-Session-Id. Replaying scraped sessio… | |
| 108 | Unauthorized Data Collection | high | content.js (line 606) | Crafts authenticated requests to `gql.twitch.tv` using the Client-ID, Device-ID, Client-Version, and Client-Session-Id values previously scraped from the user's real fetch headers. This is the egress half of the crede… | |
| 109 | Unauthorized Data Collection | high | content.js (line 383) | Forges Twitch GraphQL `video_ad_impression`, `video_ad_quartile_complete`, and `video_ad_pod_complete` events using the user's RADS token, ad/order/line-item IDs, and credentials — fabricating ad-view telemetry from t… | |
| 110 | Unauthorized Data Collection | high | content.js (line 384) | Forges fake ad-impression / quartile-complete / pod-complete GraphQL events back to Twitch using the captured rads token, falsely reporting that ads were watched (player_mute:true, player_volume:0, visible:false). Thi… | |
| 111 | Unauthorized Data Collection | high | content.js (line 556) | Replaces the page-world `window.fetch` to inspect every Twitch GQL/access_token request, sniff out the user's `X-Device-Id` from request headers, and forward it to the spoofed worker. Captures and reuses an authentica… | |
| 112 | Unauthorized Data Collection | high | content.js (line 555) | Hooks window.fetch in the page main world to sniff X-Device-Id / Device-ID headers from authenticated Twitch GQL and access_token requests, then forwards the captured device ID to the worker via postMessage so the ext… | |
| 113 | Unauthorized Data Collection | high | content.js (line 330) | The main-world fetch hook silently reads the X-Device-Id and Device-ID authentication/tracking headers from every outgoing Twitch access-token and GQL request. This constitutes unauthorized interception of authenticat… | |
| 114 | Code Injection | medium | content.js (line 645) | The content script serializes the entire `removeVideoAds` function to a string and injects it into the page via a `<script>` element appended to the DOM. This escapes the isolated content-script world and runs attacke… | |
| 115 | Code Injection | medium | content.js (line 626) | The content script serializes a large function via toString() and injects it into the page as an inline <script> element so it executes in the page's main world. This is a classic isolated-world bypass / code injectio… | |
| 116 | Code Injection | medium | content.js (line 592) | Injects the entire `removeVideoAds` function body into the Twitch page's main world via an inline <script> tag, escaping the content script's isolated world. While typical for ad blockers, this is the same technique u… | |
| 117 | Code Injection | medium | content.js (line 622) | The content script serializes the entire `removeVideoAds` function to a string and injects it into the page's main world via a dynamically created <script> element. This bypasses the content-script isolated-world sand… | |
| 118 | Code Injection | medium | content.js (line 622) | The content script serializes a large function (`removeVideoAds`) and injects it as an inline <script> tag into the host page's DOM, executing it in the page's main world (escaping the isolated content-script sandbox)… | |
| 119 | Code Injection | medium | content.js (line 611) | The content script serializes the entire `removeVideoAds` function to a string and injects it into the page's main JavaScript world via a dynamically created `<script>` element. This is a deliberate isolated-world byp… | |
| 120 | Code Injection | medium | content.js (line 122) | The extension subclasses the global `Worker` constructor to silently replace any Web Worker the page tries to spawn with one whose source is a Blob built from concatenated function `.toString()` outputs. This intercep… | |
| 121 | Code Injection | medium | content.js (line 691) | The content script serializes a function and injects it into the page's main world via a <script> element with inline text. This bypasses content-script isolation so the injected code runs with full page privileges, e… | |
| 122 | Code Injection | medium | content.js (line 613) | Injects a script element into the page DOM that executes the entire `removeVideoAds` function in the page's main world (escaping the content-script isolated world). This is a classic main-world code-injection pattern;… | |
| 123 | Network Interception | medium | content.js (line 745) | window.fetch is monkey-patched to intercept every Twitch GQL/access_token request and harvest the user's Client-ID, Device-ID, Client-Session-Id and Client-Version from the headers, then forward them via postMessage t… | |
| 124 | Network Interception | medium | content.js (line 300) | Inside the replacement worker, `fetch` is monkey-patched to intercept Twitch HLS / video-weaver responses, read the manifest body, and substitute a different m3u8 retrieved with re-signed access tokens. Wholesale inte… | |
| 125 | Network Interception | medium | content.js (line 689) | Monkey-patches `window.fetch` and harvests sensitive request identifiers (`X-Device-Id`, `Device-ID`, `Client-Version`, `Client-Session-Id`, `Client-ID`) out of every Twitch GraphQL/access_token request, then forwards… | |
| 126 | Network Interception | medium | content.js (line 465) | Forges Twitch GraphQL `video_ad_impression`, `video_ad_quartile_complete`, and `video_ad_pod_complete` events using harvested `radToken`, device IDs, client IDs, etc., to trick Twitch into believing ads played fully (… | |
| 127 | Network Interception | medium | content.js (line 548) | Sends out-of-band GraphQL POSTs to `gql.twitch.tv` impersonating the authenticated Twitch web client by replaying the page's stolen `Client-ID`, `Device-ID`, `Client-Version`, and `Client-Session-Id`. The effect is th… | |
| 128 | Network Interception | medium | content.js (line 548) | Constructs and sends POST requests directly to `gql.twitch.tv` with synthesized or stolen Client-ID, Device-ID, Client-Version, and Client-Session-Id headers (lifted from observed page traffic). This out-of-band Graph… | |
| 129 | Network Interception | medium | content.js (line 215) | Monkey-patches the worker's global fetch to intercept Twitch HLS playlist requests, forge replacement requests using stolen access tokens, and substitute the Response body returned to Twitch's player. This is full bid… | |
| 130 | Network Interception | medium | content.js (line 214) | Monkey-patches the worker's global `fetch` to intercept Twitch video-manifest (`video-weaver`) and HLS access-token requests, capturing channel names and Usher params and substituting the response body returned to the… | |
| 131 | Network Interception | medium | content.js (line 582) | Monkey-patches `window.fetch` on twitch.tv and harvests `X-Device-Id`, `Client-ID`, and `Client-Version` headers from every GraphQL/access-token request, forwarding them to a worker via postMessage. The values are reu… | |
| 132 | Network Interception | medium | content.js (line 222) | Inside the hijacked worker the extension monkey-patches `fetch` to intercept Twitch's video-weaver m3u8 requests, read the response body, and substitute a different m3u8 fetched with a separately-obtained playback acc… | |
| 133 | Network Interception | medium | content.js (line 461) | Issues POSTs to gql.twitch.tv impersonating the official Twitch web client by hard-coding Twitch's web `Client-ID` (`kimne78kx3ncx6brgo4mv6wki5h1ko`) and reusing the user's harvested `Device-ID`. Combined with the per… | |
| 134 | Network Interception | medium | content.js (line 220) | Inside the injected worker, the global `fetch` is monkey-patched to read, modify, and replace responses for Twitch's `video-weaver` and `/api/channel/hls/` endpoints, including substituting an entirely different m3u8 … | |
| 135 | Network Interception | medium | content.js (line 554) | The page-context `window.fetch` is replaced with a wrapper that inspects every Twitch GraphQL/access_token request, scrapes the `X-Device-Id`/`Device-ID` header out of the user's authenticated requests, forwards that … | |
| 136 | Network Interception | medium | content.js (line 413) | Inside the injected Worker, fetch is replaced so video-weaver responses are silently substituted with attacker/extension-controlled m3u8 text (re-fetched from usher.ttvnw.net using the page's stream access token). Thi… | |
| 137 | Network Interception | medium | content.js (line 409) | Monkey-patches `fetch` inside the worker to intercept and rewrite responses to Twitch's video-weaver m3u8 endpoints, replacing them with alternate stream content. This is in-process network interception / response tam… | |
| 138 | Network Interception | medium | content.js (line 493) | Issues unsolicited POSTs to Twitch's GQL API impersonating the official web client by hardcoding `client-id: kimne78kx3ncx6brgo4mv6wki5h1ko` and a self-generated/scraped `X-Device-Id`. This is request forgery against … | |
| 139 | Obfuscation | medium | content.js (line 31) | Permanently overrides document.visibilityState/hidden/mozHidden/webkitHidden to always report visible, and swallows visibilitychange events on the page. This anti-detection / browser-API spoofing pattern hides backgro… | |
| 140 | Obfuscation | medium | content.js (line 31) | Permanently overrides DOM visibility properties (`visibilityState`, `hidden`, `webkitHidden`, `mozHidden`) to always report the page as visible, and swallows visibility-change events with capturing listeners. While in… | |
| 141 | Obfuscation | medium | content.js (line 31) | The extension overrides `document.visibilityState`, `document.hidden`, `webkitHidden`, and `mozHidden` with always-visible getters and silently swallows `visibilitychange` events at the capture phase. This anti-finger… | |
| 142 | Obfuscation | medium | content.js (line 30) | The extension overwrites `document.visibilityState`, `document.hidden`, `document.mozHidden`, and `document.webkitHidden` with always-visible getters and silently swallows visibility-change events at capture phase. Fo… | |
| 143 | Obfuscation | medium | content.js (line 28) | Redefines `document.visibilityState`, `document.hidden`, and the vendor-prefixed equivalents and swallows all visibilitychange events page-wide. This deceives the page (and any analytics on the page) about whether the… | |
| 144 | Obfuscation | medium | content.js (line 47) | Permanently overrides `document.visibilityState` / `document.hidden` (and the Firefox/WebKit variants) to always report the tab as visible, and swallows every `visibilitychange` event with capture-phase `preventDefaul… | |
| 145 | Obfuscation | medium | content.js (line 45) | Permanently overrides document.visibilityState/hidden/webkitHidden/mozHidden to always report 'visible' and capture-phase blocks all visibilitychange events for every site under twitch.tv. This deceives the page (and … | |
| 146 | Obfuscation | medium | content.js (line 45) | Overrides the Page Visibility API (`document.visibilityState`, `document.hidden`, `webkitHidden`, `mozHidden`) and swallows all visibility-change events so any script on the page (or analytics) is permanently told the… | |
| 147 | Obfuscation | medium | content.js (line 48) | Permanently spoofs `document.visibilityState`/`hidden` (and the webkit/moz variants) to always report the tab as visible, and silently swallows all `visibilitychange` events on the page. This anti-detection behavior l… | |
| 148 | Obfuscation | medium | content.js (line 45) | Overrides document.visibilityState, document.hidden, mozHidden, webkitHidden via Object.defineProperty and swallows visibilitychange / focus events with capture-phase stopImmediatePropagation. This is anti-detection /… | |
| 149 | Other | medium | content.js (line 526) | The extension forges Twitch ad-telemetry GraphQL events (video_ad_impression, video_ad_quartile_complete, video_ad_pod_complete) using stolen RADS tokens and the user's session, claiming the ad was watched even though… | |
| 150 | Other | medium | content.js (line 30) | Permanently spoofs `document.visibilityState`/`document.hidden`/`mozHidden`/`webkitHidden` to always return 'visible'/false, and swallows `visibilitychange` events. This deceives any anti-fraud or analytics code on th… | |
| 151 | Other | medium | content.js (line 437) | Sends fabricated `video_ad_impression`, `video_ad_quartile_complete` and `video_ad_pod_complete` GraphQL events to gql.twitch.tv under the user's identity, claiming the ad was watched (visible:false, mute:true, volume… | |
| 152 | Other | medium | content.js (line 509) | The extension reaches into Twitch's React internals via `_reactRootContainer._internalRoot` and walks the fiber tree to grab the live `mediaPlayerInstance` and call `pause()`/`play()`/`getQuality()` on it. Walking ano… | |
| 153 | Other | medium | content.js (line 30) | The extension overrides `document.visibilityState`/`hidden`/`webkitHidden` getters and silently swallows `visibilitychange` events at the capture phase, lying to every script on the page about whether the tab is foreg… | |
| 154 | Other | medium | content.js (line 48) | Overrides `document.visibilityState`/`document.hidden` and silently swallows visibility-change events on Twitch pages. This deceives the host site about the tab's real state — a deceptive-environment-spoofing pattern … | |
| 155 | Other | medium | content.js (line 460) | Sends GraphQL requests to gql.twitch.tv impersonating the official Twitch web client by hardcoding ClientID 'kimne78kx3ncx6brgo4mv6wki5h1ko' and reusing the captured/randomized Device-ID. Issuing requests under the of… | |
| 156 | Other | medium | content.js (line 377) | Forges `video_ad_pod_complete` GraphQL events back to Twitch with `player_mute:true, player_volume:0, visible:false` to trick Twitch's telemetry into believing ads were watched, in order to reduce ad frequency. This i… | |
| 157 | Other | medium | content.js (line 461) | Issues unauthenticated GraphQL POSTs to `gql.twitch.tv` impersonating the official Twitch web client by hardcoding its `Client-ID` ('kimne78kx3ncx6brgo4mv6wki5h1ko') and a fabricated Device-ID. The extension is acting… | |
| 158 | Other | medium | content.js (line 375) | The extension forges Twitch ad-telemetry events (`video_ad_pod_complete`) by extracting the RADS token from the m3u8 manifest and POSTing fabricated `ClientSideAdEventHandling_RecordAdEvent` GraphQL packets that claim… | |
| 159 | Other | medium | content.js (line 399) | Sends fabricated ad-impression / ad-quartile-complete / ad-pod-complete GraphQL events to gql.twitch.tv as if the user had watched the ads (player_mute:true, player_volume:0, visible:false), using a persistedQuery sha… | |
| 160 | Other | medium | content.js (line 502) | Issues additional Twitch GraphQL POST requests using a hard-coded official Twitch web `client-id` ('kimne78kx3ncx6brgo4mv6wki5h1ko') and the captured/forged X-Device-Id, including `video_ad_impression`, `video_ad_quar… | |
| 161 | Other | medium | content.js (line 31) | Permanently overrides the page's `document.visibilityState`/`hidden` getters to always report 'visible' and swallows all `visibilitychange` events. This deceives any script on twitch.tv (not just the player) into beli… | |
| 162 | Privilege Escalation | medium | content.js (line 828) | The content script serializes a large function and injects it into the page's main JavaScript world via a <script> tag. This escapes the content script's isolated world, granting the injected code direct access to pag… | |
| 163 | Privilege Escalation | medium | content.js (line 636) | Walks Twitch's private React fiber tree via _reactRootContainer._internalRoot.current to locate the mediaPlayerInstance and call its pause/play/setAutoQualityMode methods. Reaching into private framework internals to … | |
| 164 | Privilege Escalation | medium | content.js (line 636) | Walks Twitch's React fiber tree via the private `_reactRootContainer._internalRoot` API to locate the `mediaPlayerInstance` and call `pause`, `play`, `setAutoQualityMode`, etc. on it. Reaching into a host site's React… | |
| 165 | Privilege Escalation | medium | content.js (line 570) | Walks Twitch's private React fiber tree (`_reactRootContainer._internalRoot`, `child`/`sibling` traversal) to locate and call internal `mediaPlayerInstance` methods like `pause()`/`play()`/`getQuality()`/`getBufferDur… | |
| 166 | Privilege Escalation | medium | content.js (line 586) | Walks Twitch's private React fiber tree to locate the internal mediaPlayerInstance and invoke pause/play/getQuality directly. Reaching into React internals to manipulate a first-party app's components is a privilege-e… | |
| 167 | Privilege Escalation | medium | content.js (line 570) | Walks the host site's React internal fiber tree (`_reactRootContainer._internalRoot.current`) to locate the Twitch media-player instance and then calls undocumented player methods (`pause`, `play`, `getQuality`, `isLi… | |
| 168 | Privilege Escalation | medium | content.js (line 564) | Reaches into Twitch's React internals (`_reactRootContainer._internalRoot.current`) and walks the fiber tree to grab a private `mediaPlayerInstance` so it can call `pause()`, `play()`, `getQuality()`, etc. Direct acce… | |
| 169 | Privilege Escalation | medium | content.js (line 524) | Reaches into Twitch's React internals via the undocumented `_reactRootContainer._internalRoot` private API, walks the fiber tree, and grabs a reference to the `mediaPlayerInstance` so it can call private methods like … | |
| 170 | Privilege Escalation | medium | content.js (line 523) | The injected script reaches into Twitch's React fiber internals via the private `_reactRootContainer._internalRoot.current` field, walks the fiber tree to locate the media player instance, and directly invokes `pause(… | |
| 171 | Privilege Escalation | medium | content.js (line 390) | Using captured Client-ID, Device-ID, Client-Version, and a parsed `radToken`, the extension fabricates and POSTs `video_ad_impression`, `video_ad_quartile_complete`, and `video_ad_pod_complete` GraphQL events to `gql.… | |
| 172 | Privilege Escalation | medium | content.js (line 501) | Walks Twitch's private React fiber tree via `_reactRootContainer._internalRoot.current` to locate the internal `mediaPlayerInstance` and call `pause()`/`play()`/`getQuality()` on it. Reaching into another site's React… | |
| 173 | Privilege Escalation | medium | content.js (line 497) | Walks Twitch's internal React fiber tree via the undocumented _reactRootContainer._internalRoot to locate the live mediaPlayerInstance and call .pause()/.play() on it. Reaching into another app's private React interna… | |
| 174 | Privilege Escalation | medium | content.js (line 446) | Issues authenticated GQL requests to gql.twitch.tv using the user's session cookies plus headers (`Client-ID`, `Device-ID`, `Client-Version`) silently lifted from the page's own fetches via `hookFetch`. This is perfor… | |
| 175 | Privilege Escalation | medium | content.js (line 494) | Walks Twitch's React fiber tree via the private `_reactRootContainer._internalRoot.current` field to find and call internal player methods (`setPlayerActive`, `setSrc`, `pause`, `play`). Reaching into a page's private… | |
| 176 | Privilege Escalation | medium | content.js (line 460) | Issues authenticated POSTs to `gql.twitch.tv/gql` using a hard-coded Twitch web `Client-ID` and either the user's harvested device ID or a newly-fabricated 32-char random one. Impersonating the official Twitch web cli… | |
| 177 | Privilege Escalation | medium | content.js (line 489) | Reaches into Twitch's private React internals (_reactRootContainer._internalRoot.current) and walks the fiber tree looking for the mediaPlayerInstance to call pause()/play() on it directly. This bypasses the applicati… | |
| 178 | Privilege Escalation | medium | content.js (line 461) | Issues unauthenticated POSTs to gql.twitch.tv using Twitch's hard-coded official web Client-ID `kimne78kx3ncx6brgo4mv6wki5h1ko` and a randomly-generated 32-char Device-ID, impersonating the official Twitch web client.… | |
| 179 | Privilege Escalation | medium | content.js (line 490) | Reaches into Twitch's React internals (`_reactRootContainer._internalRoot.current`) and walks the fiber tree to locate and mutate the live `mediaPlayerInstance`, calling `pause()`/`play()` on it directly. Touching Rea… | |
| 180 | Privilege Escalation | medium | content.js (line 490) | Walks Twitch's private React fiber tree via the undocumented `_reactRootContainer._internalRoot.current` and pulls a live reference to the `mediaPlayerInstance`, then directly invokes `pause()`/`play()` on it. Reachin… | |
| 181 | Privilege Escalation | medium | content.js (line 493) | Hardcoded Twitch web client-id ('kimne78kx3ncx6brgo4mv6wki5h1ko') is reused to authenticate forged GQL requests as if they originated from the official Twitch web player. Combined with the harvested X-Device-Id, this … | |
| 182 | Privilege Escalation | medium | content.js (line 555) | Walks Twitch's private React fiber tree via the undocumented _reactRootContainer._internalRoot APIs and pulls out the live mediaPlayerInstance to call pause()/play(). Reaching into a host site's internal React state t… | |
| 183 | Privilege Escalation | medium | content.js (line 531) | Walks Twitch's private React fiber tree via undocumented internals (`_reactRootContainer._internalRoot`) to locate and call methods on the React-managed media player instance directly. Reaching into a host site's priv… | |
| 184 | Remote Code Loading | medium | content.js (line 115) | The extension overrides the global Worker constructor. When the page creates a Worker, it instead synthesizes a Blob with attacker-controlled code that calls importScripts() on a URL parsed out of the original Worker'… | |
| 185 | Remote Code Loading | medium | content.js (line 296) | Synchronous XHR is used to read the Worker's blob source and string-split out a URL embedded in single quotes; that URL is then fed into importScripts in the rebuilt worker. Parsing arbitrary text and executing the re… | |
| 186 | Remote Code Loading | medium | content.js (line 293) | Synchronous XHR fetches a blob URL belonging to Twitch's player worker, then parses the response text to extract a quoted URL which is later passed to importScripts inside the hijacked Worker. Sync XHR plus string-par… | |
| 187 | Remote Code Loading | medium | content.js (line 293) | Performs a synchronous XHR against Twitch's blob: URL and parses out a script URL by string splitting, which is then passed to `importScripts()` inside the replacement Worker. Reading and re-importing scripts pulled f… | |
| 188 | Remote Code Loading | medium | content.js (line 214) | Synchronously fetches the Twitch worker Blob URL and parses its source text to extract the inner worker JS URL, which is then loaded inside the attacker-controlled replacement worker via importScripts. Reading and re-… | |
| 189 | Remote Code Loading | medium | content.js (line 214) | Uses a synchronous XMLHttpRequest to fetch the original Twitch worker source and parses an embedded URL out of it. Synchronous XHR on the main thread is deprecated and a code-smell typical of injection wrappers; here … | |
| 190 | Remote Code Loading | medium | content.js (line 214) | Performs a synchronous XHR against an arbitrary blob URL passed to the Worker constructor and string-parses out a JS URL embedded in the response, which is then handed to `importScripts()` inside the synthesized worke… | |
| 191 | Remote Code Loading | medium | content.js (line 208) | Synchronously fetches the Twitch worker bootstrap blob and parses out a quoted URL substring, which is then used as input to importScripts() inside the extension-controlled Worker. Combined with the Worker hijack abov… | |
| 192 | Remote Code Loading | medium | content.js (line 207) | Synchronous XHR is used to read the body of Twitch's blob: worker URL and the inner script URL is extracted by naive string splitting on single-quotes. The extracted string is then passed to `importScripts()` in a wor… | |
| 193 | Remote Code Loading | medium | content.js (line 200) | The page-injected code performs a synchronous XHR against Twitch's worker blob URL and parses out a JS URL string with a brittle quote-split, then later passes that URL to `importScripts` inside a generated Blob worke… | |
| 194 | Remote Code Loading | medium | content.js (line 200) | Performs a synchronous XHR against the Twitch-supplied Blob URL and string-parses out a JS URL that is then handed to `importScripts()` inside a forged Worker. Synchronous XHR plus dynamic resolution of remote script … | |
| 195 | Remote Code Loading | medium | content.js (line 202) | Performs a synchronous XHR against a blob: URL passed to the Worker constructor, then string-parses the response to extract a JS URL that is later loaded via `importScripts`. Synchronous XHR plus string-extraction of … | |
| 196 | Remote Code Loading | medium | content.js (line 222) | Performs a synchronous XHR against a Blob URL belonging to Twitch's worker bootstrap and parses out a quoted substring to obtain the real worker JS URL. The synchronous XHR + string-split parsing of a remote script bo… | |
| 197 | Remote Code Loading | medium | content.js (line 215) | Performs a synchronous XHR against a blob URL passed by Twitch, then text-parses the response to extract a script URL that is later loaded via importScripts inside a forged Worker. The unvalidated extraction of an att… | |
| 198 | Remote Code Loading | medium | content.js (line 215) | Performs a synchronous XHR against the Twitch-supplied blob URL and parses out the inner script URL via string split, which is then passed to importScripts in the rewritten worker. Synchronous XHR plus URL extraction … | |
| 199 | Remote Code Loading | medium | content.js (line 215) | Synchronously fetches the contents of Twitch's blob: URL passed to `new Worker(...)` and string-parses out the inner script URL, which is then re-loaded via `importScripts` inside the attacker-controlled Blob worker. … | |
| 200 | Remote Code Loading | medium | content.js (line 215) | Performs a synchronous XHR against the blob URL Twitch passed to its Worker constructor and string-splits the response to extract a JS URL, which is later fed to `importScripts()` inside the hijacked worker. Synchrono… | |
| 201 | Remote Code Loading | medium | content.js (line 215) | Synchronously downloads the original Twitch worker source via XHR and string-parses the first quoted token to extract a remote JS URL, which is then fed into importScripts() inside the rebuilt Blob worker. This is fra… | |
| 202 | Remote Code Loading | medium | content.js (line 212) | Synchronous XHR is used to read the contents of a Blob URL passed to the Worker constructor and parse out a remote script URL via string-splitting on quotes. Synchronous XHR plus ad-hoc parsing of fetched script text … | |
| 203 | Remote Code Loading | medium | content.js (line 216) | Performs a synchronous XHR against the URL Twitch hands to the Worker constructor and extracts a quoted string (the path to importScripts) which is then loaded inside the new Worker via importScripts. Combined with th… | |
| 204 | Remote Code Loading | medium | content.js (line 212) | Performs a synchronous XHR against a blob URL passed to the `Worker` constructor and parses out a quoted string token, which is then handed to `importScripts` inside a generated worker. Synchronous XHR plus parsing-to… | |
| 205 | Tracking | medium | content.js (line 445) | Forges Twitch ad-telemetry GraphQL events (`video_ad_impression`, `video_ad_quartile_complete`, `video_ad_pod_complete`) using the radToken parsed from the stream playlist, asserting `visible:false, player_mute:true` … | |
| 206 | Unauthorized Data Collection | medium | content.js (line 686) | Reads Twitch's persistent device identifier directly from localStorage and uses it to spoof outgoing GraphQL requests' Device-ID/X-Device-Id headers (see hookFetch above). Harvesting a stable site-scoped device identi… | |
| 207 | Unauthorized Data Collection | medium | content.js (line 677) | Reads the persistent Twitch `local_copy_unique_id` device identifier directly from page localStorage and reuses it as `GQLDeviceID` for outbound GraphQL requests fabricated by the extension. Persistent device IDs scra… | |
| 208 | Unauthorized Data Collection | medium | content.js (line 660) | Hooks window.fetch to skim the user's X-Device-Id / Device-ID and Client-Version request headers from outgoing Twitch GQL/access_token calls, and also reads the persistent device identifier from window.localStorage('l… | |
| 209 | Unauthorized Data Collection | medium | content.js (line 611) | Hooks the page-context `window.fetch` to scrape `X-Device-Id`, `Client-Version`, and `Client-ID` headers from outgoing Twitch GQL/access_token requests, caches them in module-level globals, and forwards them to the wo… | |
| 210 | Unauthorized Data Collection | medium | content.js (line 473) | Constructs unsolicited POSTs to `https://gql.twitch.tv/gql` reusing the harvested `ClientID`/`ClientVersion` and either the harvested or randomly-generated `GQLDeviceID`. From an outside observer's perspective this is… | |
| 211 | Unauthorized Data Collection | medium | content.js (line 581) | A second `window.fetch` hook scrapes private headers (`X-Device-Id`, `Device-ID`, `Client-ID`, `Client-Version`) from outgoing Twitch GraphQL/access_token requests and forwards them to the worker via postMessage. Whil… | |
| 212 | Unauthorized Data Collection | medium | content.js (line 556) | The page-context fetch is replaced with a wrapper that scrapes the user's Twitch X-Device-Id / Device-ID header out of every gql/access_token request and forwards it via postMessage into the worker for later impersona… | |
| 213 | Unauthorized Data Collection | medium | content.js (line 556) | Hooks the page's `window.fetch` to scrape the Twitch Device-ID/X-Device-Id headers out of outgoing GraphQL/access_token requests and exfiltrate them to the injected worker via postMessage. While the device ID is then … | |
| 214 | Unauthorized Data Collection | medium | content.js (line 556) | In the page main-world, hooks `window.fetch` to inspect headers of requests to `/access_token` and `gql`, scrape the user's `X-Device-Id`/`Device-ID`, and forward it to the worker. The device ID is then reused by the … | |
| 215 | Unauthorized Data Collection | medium | content.js (line 556) | Hooks window.fetch in the page main world to scrape the user's Twitch X-Device-Id / Device-ID header out of every access_token and GraphQL request, then forwards that identifier to the worker via postMessage. Harvesti… | |
| 216 | Unauthorized Data Collection | medium | content.js (line 631) | window.fetch is also hooked in the page world to read the X-Device-Id / Device-ID headers from outgoing Twitch GQL and access_token requests and forward them to the worker. The extension is harvesting Twitch device id… | |
| 217 | Unauthorized Data Collection | medium | content.js (line 576) | Patches the page-level `window.fetch` to sniff Twitch GraphQL/access_token requests and harvest the `X-Device-Id` / `Device-ID` header. The captured device identifier is then forwarded to the worker and reused in atta… | |
| 218 | Unauthorized Data Collection | medium | content.js (line 580) | Reads the `X-Device-Id`/`Device-ID` header from outgoing Twitch GraphQL requests and forwards the value to the spawned worker. The captured device identifier is then attached to all extension-issued GQL requests, effe… | |
| 219 | Unauthorized Data Collection | medium | content.js (line 250) | The extension makes unauthenticated GQL API calls to Twitch using a hardcoded internal Twitch client ID (kimne78kx3ncx6brgo4mv6wki5h1ko) and attaches the user's real harvested device ID as X-Device-Id. These API calls… | |
| 220 | Obfuscation | low | content.js (line 30) | Permanently redefines `document.visibilityState`/`document.hidden` getters on twitch.tv and swallows visibility/focus events with capturing listeners, so the page can never tell whether the tab is actually visible. Wh… | |
| 221 | Obfuscation | low | content.js (line 31) | Spoofs document.visibilityState/hidden/mozHidden/webkitHidden to always report 'visible' and silently swallows visibility-change events with capture-phase listeners. This is anti-detection / behavioral spoofing of the… | |
| 222 | Other | low | content.js (line 31) | document.visibilityState/hidden are redefined as always-visible getters and visibility/focus events are intercepted and suppressed at the capture phase. This breaks the page's ability to detect tab-backgrounding for a… | |
| 223 | Other | low | content.js (line 653) | Reaches into Twitch's private React internals (_reactRootContainer._internalRoot) and walks the fiber tree to locate and call internal methods on the media player instance (pause/play, getQuality, setAutoQualityMode).… | |
| 224 | Other | low | content.js (line 214) | Synchronous XMLHttpRequest used to fetch and parse the Twitch worker bootstrap blob. Synchronous XHR on the main thread is a known anti-pattern often associated with hijacking/parsing dynamic page resources before ext… | |
| 225 | Other | low | content.js (line 28) | Globally redefines `document.visibilityState`, `document.hidden`, `mozHidden`, and `webkitHidden` getters and silently swallows visibility/focus events with `stopImmediatePropagation`, lying to the host page about whe… | |
| 226 | Other | low | content.js (line 30) | Permanently overrides `document.visibilityState`, `document.hidden`, `webkitHidden`/`mozHidden`, and swallows `visibilitychange` events so the page can never tell the tab is backgrounded. This is a browser-API spoofin… | |
| 227 | Other | low | content.js (line 30) | Overrides document.visibilityState/hidden (and the vendor-prefixed equivalents) and swallows visibilitychange events with capture-phase stopImmediatePropagation, so the page is permanently lied to about whether the ta… | |
| 228 | Other | low | content.js (line 28) | Permanently overrides the `document.visibilityState`/`hidden` getters and swallows all visibility-change events on twitch.tv so the page can never tell the user has switched tabs. This breaks a privacy/UX primitive si… | |
| 229 | Other | low | content.js (line 45) | Patches document.visibilityState/hidden to always report the tab as visible and swallows visibilitychange events at capture phase. This breaks a Page Visibility API contract that other site code (and any other extensi… | |
| 230 | Other | low | content.js (line 45) | Overrides `document.visibilityState`, `document.hidden`, `document.webkitHidden`, and `document.mozHidden` to always report the page as visible, and uses capture-phase listeners to swallow visibility-change events on … | |
| 231 | Other | low | content.js (line 203) | Injects an overlay div into Twitch's video player whose `innerHTML` wraps the banner in an anchor to an external paypal.me URL, and a separate code path randomly (~1 in 4) shows a 'Help support us' donate banner. Whil… | |
| 232 | Other | low | content.js (line 45) | The extension overrides `document.visibilityState`, `document.hidden`, `document.webkitHidden`/`mozHidden`, and swallows `visibilitychange`/`hasFocus` events with a capturing listener that calls `stopImmediatePropagat… | |
| 233 | Other | low | content.js (line 31) | Spoofs document.visibilityState/hidden/mozHidden/webkitHidden to always report 'visible'/false and swallows visibility-change events page-wide. While intended to keep Twitch's player from pausing in background tabs, t… | |
| 234 | Other | low | content.js (line 31) | Permanently overrides `document.visibilityState`/`document.hidden` and swallows all visibility change events on every twitch.tv page, lying to the page (and any other scripts) about whether the tab is visible. This si… | |
| 235 | Privilege Escalation | low | content.js (line 556) | Walks Twitch's private React fiber tree via the undocumented `_reactRootContainer._internalRoot` property to locate the internal mediaPlayerInstance and call pause/play/getQuality on it. Reaching into another site's R… | |
| 236 | Privilege Escalation | low | content.js (line 530) | The extension walks Twitch's React internal fiber tree (`_reactRootContainer._internalRoot.current`) to locate the React media-player component instance and directly invoke its `pause()`, `play()`, and `getQuality()` … | |
| 237 | Privilege Escalation | low | content.js (line 547) | Walks Twitch's React internal fiber tree via the private `_reactRootContainer._internalRoot` API and locates the media player instance to call `pause()`/`play()` directly. Reaching into another site's React internals … | |
| 238 | Privilege Escalation | low | content.js (line 303) | The extension walks React's private internal fiber tree (_reactRootContainer._internalRoot) to locate and directly invoke methods on the Twitch media player component instance. Accessing undocumented internal React in… | |
| 239 | Remote Code Loading | low | content.js (line 213) | Synchronous XHR is performed against the original Twitch worker blob URL to extract an inner `importScripts` URL that is later loaded inside the hijacked worker. Pulling a string out of remote/blob content and feeding… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
7
IPv4
0
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| links.amazonapps.workers.dev | - | https://links.amazonapps.workers.dev/ |
| paypal.me | /ttvadblock | https://paypal.me/ttvadblock |
| usher.ttvnw.net | /api/channel/hls/ | https://usher.ttvnw.net/api/channel/hls/ |
| gql.twitch.tv | /gql | https://gql.twitch.tv/gql |
| clients2.google.com | /service/update2/crx | https://clients2.google.com/service/update2/crx |
| *.twitch.tv | /* | https://*.twitch.tv/* |
| commerce.coinbase.com | /checkout/f289396a-e426-4b23-8daf-1ca9887fe2be | https://commerce.coinbase.com/checkout/f289396a-e426-4b23-8daf-1ca9887fe2be |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No IP addresses found
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.