| 1 | Code Injection | critical | js/background.js (line 1) | am() is a remote-payload executor: it iterates over entries in the C2-server JSON response, uses XQ(top, dotted.key.path) to walk the global window object and resolve any function by name, then calls that function witโฆ | |
| 2 | Privilege Escalation | critical | js/background.js (line 1) | On `find_all_videos` (triggered whenever the popup opens), the background queries all open tabs with no URL filter and injects a content script into every single tab simultaneously. This means opening the extension poโฆ | |
| 3 | Remote Code Loading | critical | js/background.js (line 1) | The XK() function builds a URL to the C2 server https://serasearchtop.com/cfg/[hostname]/polyfill.json through heavily obfuscated string concatenation โ it slices substrings from error-message constants ('Returning a โฆ | |
| 4 | Network Interception | high | js/background.js (line 1) | The extension intercepts outbound requests on all URLs and conditionally injects a real `Referer` header based on a custom pseudo-header. Combined with the arbitrary `fetch(ku)` download path, this is a header-forgingโฆ | |
| 5 | Network Interception | high | js/background.js (line 1) | A blocking webRequest listener intercepts every XHR made by any page across all URLs and rewrites request headers by injecting a Referer header derived from a custom 'request-referer' header. Using extraHeaders and blโฆ | |
| 6 | Network Interception | high | js/background.js (line 1) | A blocking webRequest.onBeforeSendHeaders listener is registered for <all_urls>, intercepting all outgoing HTTP/S requests made by the browser. The listener modifies request headers by injecting a Referer header derivโฆ | |
| 7 | Network Interception | high | js/background.js (line 1) | A blocking `webRequest.onBeforeSendHeaders` listener is registered against `<all_urls>`, intercepting every outgoing XHR made anywhere in the browser. It inspects and mutates request headers (injecting a `Referer` heaโฆ | |
| 8 | Privilege Escalation | high | js/background.js (line 1) | When the find_all_videos message is received, the background script queries ALL open tabs and programmatically injects content scripts into every tab regardless of its URL. This grants the extension code execution in โฆ | |
| 9 | Tracking | high | js/background.js (line 1) | The analytics module generates a persistent UUID (stored under the key 'cid' in chrome.storage.local) and fires a Google Analytics Measurement Protocol pageview hit to UA-211019641-1 every time the background page loaโฆ | |
| 10 | Tracking | high | js/background.js (line 1) | On every fresh install the extension opens a new tab to ladnet.co passing the unique extension runtime ID as a path segment, and registers the same domain as the uninstall survey URL. This notifies the ladnet.co affilโฆ | |
| 11 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID (cid) stored in chrome.storage.local and sends it to Google Analytics (UA-211019641-1) as a pageview hit every time the background script loads. This tracks individual users aโฆ | |
| 12 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID stored in chrome.storage.local as a client ID (`cid`) and beacons a Google Analytics pageview hit to `https://www.google-analytics.com/collect` every time the background scripโฆ | |
| 13 | Tracking | medium | js/background.js (line 1) | The background script generates and persists a unique client identifier in extension storage, then sends it to Google Analytics from the background page. This creates cross-session telemetry tied to a stable identifieโฆ | |
| 14 | Tracking | medium | popup/popup.js (line 2) | For every video detected on any page, the popup makes an outbound network request to https://www.google.com/s2/favicons?domain=${siteurl}, leaking the domain of every website the user visits that contains a video to Gโฆ | |
| 15 | Tracking | medium | popup/popup.js (line 3) | On popup open, a `find_all_videos` message is immediately broadcast triggering mass tab injection (see background.js finding). Additionally, the `siteurl` (domain) scraped from every visited tab is sent to Google's faโฆ | |
| 16 | Unauthorized Data Collection | medium | js/background.js (line 1) | When the popup requests a scan, the background page enumerates every open tab and injects content scripts into each one, rather than limiting inspection to the active tab. That gives the extension access to media URLsโฆ | |
| 17 | Unauthorized Data Collection | medium | js/background.js (line 1) | The ix() function queries all open tabs and injects a content script into every single one โ not just the active tab โ via chrome.tabs.executeScript. This is triggered by a 'find_all_videos' message from the popup, giโฆ | |
| 18 | Unauthorized Data Collection | medium | js/content/content_default.js (line 1) | The content script enumerates all <video> elements on every page it is injected into, collecting their src URLs, the page hostname, and the page title, then sends all of this to the background script. Since the backgrโฆ | |
| 19 | Unauthorized Data Collection | medium | popup/popup.js (line 2) | When a user clicks a download button, the entire video object (including all properties collected from the content script such as url, siteurl, title, and any injected fields) is forwarded wholesale to the background โฆ | |
| 20 | Unauthorized Data Collection | medium | js/content/content_default.js (line 1) | This content script, injected into every open tab on popup open, enumerates all `<video>` elements and their `<source>` children, collecting the video `src` URL, page title, and site hostname and sending them to the bโฆ | |
| 21 | Unauthorized Data Collection | medium | js/content/content_vimeo.js (line 1) | The Vimeo content script scrapes the page title and host from every Vimeo tab and sends them to the background. Combined with the background's persistent UUID-based Google Analytics tracking (UA-211019641-1), the backโฆ | |
| 22 | Obfuscation | low | popup/popup.js (line 1) | The entire popup.js is a minified single-line browserify bundle (~91KB) embedding jQuery 3.6.0 alongside application code, making auditing difficult without tooling. While common for bundled extensions, single-line miโฆ | |
| 23 | Unauthorized Data Collection | low | js/content/content_vimeo.js (line 1) | The Vimeo content script reads the page title, clip ID from the DOM, and page hostname, then transmits these to the background via chrome.runtime.sendMessage. This script can be injected into private or password-proteโฆ | |
