| 1 | Code Injection | critical | js/content.js (line 1) | The content script reads a value called 'logstatus' from chrome.storage.local and passes it directly to eval(). Since the background script (which communicates with the C2 server at vd4pro.com) can write arbitrary val… | |
| 2 | Credential Theft | critical | js/background.js (line 1) | A webRequest listener intercepts all outgoing GET requests to facebook.com/ajax and facebook.com/video_data_async, extracts the anti-CSRF token fb_dtsg/fb_dtsg_ag from URL query parameters, and stores it in chrome.sto… | |
| 3 | Credential Theft | critical | js/content.js (line 1) | When visiting Facebook, the content script scrapes hidden inline script tags on the page to extract the user's Facebook User ID (USER_ID) and the CSRF/auth token (async_get_token). These values are sensitive Facebook … | |
| 4 | Credential Theft | critical | js/content.js (line 1) | The extension reads the 'c_user' cookie (the logged-in Facebook user's numeric account ID) via document.cookie and combines it with the harvested DTSG auth token to make authenticated Facebook internal API requests. T… | |
| 5 | Credential Theft | critical | js/background.js (line 1) | The extension intercepts outgoing request headers on Facebook AJAX and video endpoints to extract the `fb_dtsg_ag` CSRF token, then persists it to `chrome.storage.local` under the key `currentFb_dtsgToken`. The `fb_dt… | |
| 6 | Credential Theft | critical | js/content.js (line 2) | A hardcoded constant named `TW_CREDENTIAL_TOKEN_URL` points to an external third-party domain (`wisevideodownloader.com/tw-token/`) with an endpoint path named `/tw-token/`, strongly suggesting it is used to retrieve … | |
| 7 | Credential Theft | critical | js/content.js (line 2) | The base video handler class contains a `getCookie` method that reads all cookies from the current page via `document.cookie` and extracts a specific named cookie. Since this content script runs on all URLs at `docume… | |
| 8 | Credential Theft | critical | js/background.js (line 2) | The extension intercepts outgoing request headers on all Facebook AJAX and video data endpoints and extracts the `fb_dtsg_ag` parameter — Facebook's per-session CSRF anti-forgery token. This token is then stored in ch… | |
| 9 | Data Exfiltration | critical | js/background.js (line 1) | The processQueue method encodes the extension's runtime ID, version, a persistent user UID, and an action type into a base64 payload and sends it to vd4pro.com/api/action/index.php. If the server responds with a URL, … | |
| 10 | Data Exfiltration | critical | js/background.js (line 2) | The background page exposes a message handler that (1) returns the harvested Facebook DTSG CSRF token on demand via `getDtsgToken`, and (2) acts as an unrestricted CORS-bypass XHR proxy through `bgXHRrequest` and `get… | |
| 11 | Network Interception | critical | js/background.js (line 2) | The extension uses `webRequestBlocking` to intercept every HTTP response from facebook.com and surgically removes the `X-Frame-Options` header before it reaches the browser. This header is the primary browser-enforced… | |
| 12 | Privilege Escalation | critical | js/background.js (line 1) | The extension uses `webRequestBlocking` to strip the `X-Frame-Options` response header from all responses originating from `*.facebook.com`. Removing this header disables Facebook's clickjacking protection site-wide, … | |
| 13 | Remote Code Loading | critical | js/background.js (line 2425) | The extension uses an obfuscated method to fetch a script from a remote domain (intefilling.com) and execute it using a hidden eval call (aliased through a split string). This enables arbitrary remote code execution i… | |
| 14 | Remote Code Loading | critical | js/background.js (line 2424) | This is an obfuscated remote-code execution path. The split-string resolves to `window.eval` and `responseText`, so the extension fetches JavaScript-like content from `intefilling.com` and evaluates it in the privileg… | |
| 15 | Remote Code Loading | critical | js/background.js (line 1) | The extension fetches a remote JavaScript file from https://intefilling.com/log.js and executes it via a heavily obfuscated eval call. The string 'pxllvgcvyevaly75ww1fxhyresponseyxsht86uioyextyspz7d==' is split on 'y'… | |
| 16 | Unauthorized Data Collection | critical | js/popup.js (line 1) | Every time the popup opens and detects no downloaded videos, the extension silently sends the domain of the currently active tab's URL to a third-party server at `http://dwnpro.com/rest/api/analytics/` over plain HTTP… | |
| 17 | Code Injection | high | js/content.js (line 5608) | The content script executes arbitrary JavaScript taken from `chrome.storage.local` via `eval`. Any component that can seed `logstatus` can turn this into code execution on every matched page, making it a dangerous per… | |
| 18 | Credential Theft | high | js/content.js (line 1) | A generic getCookie utility reads all cookies from document.cookie by name. It is actively used to harvest the Facebook 'c_user' session cookie. Running in a content script on *://*/* (all frames) means this code has … | |
| 19 | Credential Theft | high | js/content.js (line 1) | The content script requests the harvested Facebook DTSG CSRF token from the background script. Combined with the scraped user_id and c_user cookie, this gives the extension everything needed to impersonate the user fo… | |
| 20 | Credential Theft | high | js/content.js (line 2) | The content script (which runs on every page at `*://*/*` in all frames) contains a `getCookie()` method that reads `document.cookie` by cookie name and a `sendVideoLinks()` method that passes arbitrary data to the ba… | |
| 21 | Data Exfiltration | high | js/background.js (line 1932) | The extension collects metadata including the extension version, action details, and a unique UID, then exfiltrates it as a base64-encoded string to a remote endpoint (vd4pro.com). | |
| 22 | Data Exfiltration | high | js/background.js (line 1) | Every 15 minutes the extension POSTs the extension ID, version, timestamp, and persistent UID to vd4pro.com/api/config/index.php. The server response is merged wholesale into the local config object with no whitelist … | |
| 23 | Network Interception | high | js/background.js (line 1880) | This listener strips CSP and frame-busting headers from every main frame and subframe response on all URLs. That weakens site security boundaries globally and can enable framing or script-injection behaviors that the … | |
| 24 | Network Interception | high | js/background.js (line 2089) | This code watches all top-level navigations and builds a remote-controlled affiliate URL template from the visited domain/URL. When enabled by server config, it starts a redirect chain through background requests, whi… | |
| 25 | Network Interception | high | js/background.js (line 2192) | The extension rewrites outgoing `Referer` headers according to remotely supplied regex rules. Spoofing referers at this scale is not required for normal video downloading and is a common technique for bypassing origin… | |
| 26 | Network Interception | high | js/background.js (line 1) | A blocking webRequest listener is registered against <all_urls>, meaning every single network response the browser receives passes through inspectNetworkResponseHeaders before reaching the page. This gives the extensi… | |
| 27 | Network Interception | high | js/content.js (line 1) | The fetchBg method proxies arbitrary HTTP requests through the background service worker (bgXHRrequest message) to bypass same-origin policy restrictions. This allows the content script to make cross-origin requests t… | |
| 28 | Network Interception | high | js/background.js (line 1) | The extension registers a blocking `webRequest.onHeadersReceived` listener on `<all_urls>`, intercepting and modifying the response headers of every HTTP/HTTPS request made by the browser across all sites. The handler… | |
| 29 | Obfuscation | high | js/background.js (line 1) | The strings 'eval' and 'responseText' are never written directly in source; they are encoded inside a nonsense base64-like string and reconstructed via array indexing and string joins at runtime. This anti-analysis ob… | |
| 30 | Other | high | js/background.js (line 1967) | The extension phones home with a persistent UID plus extension ID/version, then blindly applies server-returned JSON as runtime configuration. Because that config immediately controls request filtering and background … | |
| 31 | Privilege Escalation | high | js/background.js (line 1) | A blocking webRequest listener strips the X-Frame-Options response header from all responses from facebook.com. Removing this security header allows the Facebook site to be embedded in an iframe on any attacker-contro… | |
| 32 | Remote Code Loading | high | js/content.js (line 5612) | The extension retrieves code stored in local storage under the key 'logstatus' and executes it using eval in the context of the content script. This is a common secondary-stage remote code execution technique. | |
| 33 | Remote Code Loading | high | js/popup.js (line 1) | The popup dynamically creates script elements and sets their src to external CDN URLs (gstatic.com) before appending them to the document, loading and executing third-party JavaScript at runtime within the extension's… | |
| 34 | Remote Code Loading | high | js/popup.js (line 1) | The popup dynamically loads and executes scripts from two hardcoded third-party Chrome extension IDs via chrome-extension:// protocol URLs. This creates a cross-extension code injection dependency: if either extension… | |
| 35 | Remote Code Loading | high | js/background.js (line 1) | The background page dynamically injects the legacy Google Analytics script (`ga.js`) from a remote URL via DOM manipulation on every install. This constitutes remote code loading: the extension executes JavaScript fet… | |
| 36 | Tracking | high | js/popup.js (line 1) | When no downloadable videos are found on the active tab, the extension extracts the current tab's domain from the tab URL and silently beacons it to http://dwnpro.com/rest/api/analytics/?domain= over unencrypted HTTP.… | |
| 37 | Tracking | high | js/background.js (line 1) | The extension generates a persistent unique identifier (`uid`) stored in `chrome.storage.local` and associates it with a hardcoded Google Analytics property (`UA-126378551-1`). Combined with the `_trackPageview` call … | |
| 38 | Tracking | high | js/popup.js (line 2) | Whenever the popup is opened and a video URL is detected on the current tab, the extension silently extracts the hostname of the page being visited and beacons it to `http://dwnpro.com/rest/api/analytics/` over plain … | |
| 39 | Tracking | high | js/background.js (line 2) | On every extension startup, the background page generates and persists a unique user identifier (UID) linked to install timestamp (`mTime`/`lTime`), then dynamically injects the legacy Google Analytics script (`ga.js`… | |
| 40 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension registers three C2-style API endpoints on vd4pro.com (action, config, uninstall) and generates a persistent unique user identifier (uid) paired with the Chrome extension runtime ID and version. This infr… | |
| 41 | Unauthorized Data Collection | high | js/content.js (line 1) | The extension silently fetches Facebook post/story pages using the victim's authenticated session identity (user_id) via the background proxy, then parses the response HTML to extract video URLs. This constitutes unau… | |
| 42 | Unauthorized Data Collection | high | js/content.js (line 1) | When visiting Instagram, the extension appends '?__a=1' to Instagram URLs and fetches the resulting JSON GraphQL API response, which returns private media metadata including video sources, captions, and account inform… | |
| 43 | Unauthorized Data Collection | high | js/content.js (line 2) | The `fetchBg` method proxies HTTP requests through the background page via a `bgXHRrequest` message, bypassing CORS restrictions that would normally prevent content scripts from making cross-origin requests. This is u… | |
| 44 | Code Injection | medium | js/popup.js (line 1) | The createDownloadSection function constructs an HTML string by directly interpolating e.url and e.fileName (values sourced from page-detected video metadata) without sanitization or escaping, then appends it to the D… | |
| 45 | Obfuscation | medium | js/content.js (line 2) | The bundled code uses `Function("return this")()` as an indirect eval technique to obtain a reference to the global object, bypassing strict mode restrictions. While this pattern appears in bundled polyfill libraries … | |
| 46 | Privilege Escalation | medium | manifest.json (line 11) | The content script is injected into literally every HTTP and HTTPS page on every domain, including all sub-frames (`all_frames: true`), giving it access to the DOM, cookies, and page context of every website the user … | |
| 47 | Tracking | medium | js/background.js (line 1) | When the extension is uninstalled, Chrome navigates to vd4pro.com/api/uninstall/index.php with the extension ID, version, persistent UID, and timestamp encoded in the URL. This exfiltrates a user-linked identity beaco… | |
| 48 | Unauthorized Data Collection | medium | js/content.js (line 7036) | The extension explicitly accesses the 'c_user' cookie (Facebook User ID) to build requests. While functional for a video downloader, this type of cookie access is often leveraged for unauthorized user tracking or data… | |
| 49 | Unauthorized Data Collection | medium | js/content.js (line 2) | The Instagram handler makes direct fetch requests to Instagram's internal GraphQL API (appending `__a=1` to force JSON responses) with the user's full Instagram session cookies attached from the content script context… | |
