| 1 | Obfuscation | critical | js/popup.js (line 1) | A heavily obfuscated function VE() constructs a remote URL by splitting the hostname across multiple variables (nd='ht', HE='fe', fragments like 'asea', 'rc', 'op', '/cf', '.c', 'om') to conceal the endpoint from stat… | |
| 2 | Privilege Escalation | critical | js/background.js (line 1) | On install, the background page queries ALL currently open tabs and programmatically injects 'js/content.js' into every tab including all frames ('allFrames: true') via 'tabs.executeScript'. This silently injects code… | |
| 3 | Remote Code Loading | critical | js/popup.js (line 1) | JU() receives a JSON object from the remote server and dynamically resolves dot-separated property paths against the window/top global scope (via LB()) to invoke arbitrary browser or extension API functions with serve… | |
| 4 | Unauthorized Data Collection | critical | js/background.js (line 1) | The extension captures a live audio stream from the active browser tab using chrome.tabCapture.capture with audio:true. The captured MediaStream is stored in a global map keyed by tab ID and routed through an AudioCon… | |
| 5 | Unauthorized Data Collection | critical | js/background.js (line 1) | The background script calls `chrome.tabCapture.capture` with `{audio: true, video: false}` to capture the live audio stream of any tab and stores the resulting `MediaStream` object in a module-level map keyed by tab I… | |
| 6 | Data Exfiltration | high | js/popup.js (line 1) | VE() uses localStorage to persist a timestamp and only fires its remote beacon when the elapsed time exceeds ~82,845,351 ms (approximately 23 hours). This time-gating is specifically designed to defeat short-duration … | |
| 7 | Obfuscation | high | js/popup.js (line 1) | The entire 109KB popup.js file is a single-line minified Browserify bundle with pervasive 2-character obfuscated variable names (SG, zP, BF, Vt, BI, ak, etc.) applied to all identifiers throughout the entire codebase … | |
| 8 | Privilege Escalation | high | js/background.js (line 1) | On installation, the background script programmatically injects `js/content.js` into every currently open tab via `tabs.executeScript` with `allFrames: true`, including tabs that may contain sensitive content such as … | |
| 9 | Privilege Escalation | high | js/background.js (line 1) | On installation, the extension programmatically injects content.js into every currently open tab (all frames, all iframes) using tabs.executeScript in a loop with a bare catch block that silently swallows errors. This… | |
| 10 | Privilege Escalation | high | js/background.js (line 1) | On installation the background script programmatically injects `js/content.js` into every currently-open tab via `tabs.query({})` with `allFrames: true`, covering all iframes across all pages open at install time. Thi… | |
| 11 | Remote Code Loading | high | js/popup.js (line 1) | jQuery's bundled '_evalUrl' method fetches a remote URL via synchronous AJAX and executes the response body as JavaScript using 'globalEval', which injects a script element into document.head. This provides a ready me… | |
| 12 | Remote Code Loading | high | js/popup.js (line 1) | jQuery's 'ajaxTransport' for the 'script' dataType dynamically creates a script element with the requested URL as its 'src' and appends it to 'document.head', enabling cross-domain script loading by bypassing same-ori… | |
| 13 | Tracking | high | js/background.js (line 1) | The extension generates and persists a UUID-based client ID ('cid') in chrome.storage.local, then unconditionally sends a Google Analytics Measurement Protocol pageview hit to 'https://www.google-analytics.com/collect… | |
| 14 | Tracking | high | js/popup.js (line 1) | The obfuscated VE() function appends document.location.host (the current page's hostname, stored as XU) and a localStorage key to the URL before making the remote request. This transmits the user's current browsing co… | |
| 15 | Tracking | high | js/background.js (line 1) | The background script silently sends a Google Analytics pageview beacon (UA-201292818-1) on every startup, transmitting a persistent UUID client ID (cid) stored in chrome.storage.local. This UUID is generated once and… | |
| 16 | Tracking | high | js/background.js (line 1) | The extension generates and persists a UUID-based client ID (`cid`) in local storage to uniquely identify each installation, then fires a Google Analytics Measurement Protocol pageview hit to `https://www.google-analy… | |
| 17 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID stored as `cid` in chrome.storage.local and silently sends it to Google Analytics (UA-201292818-1) as a pageview hit every time the background service worker starts. This cons… | |
| 18 | Tracking | high | js/background.js (line 1) | The extension generates a persistent UUID (stored as `cid` in chrome.storage.local) on first run and sends it to Google Analytics (`UA-201292818-1`) via the Measurement Protocol every time the background script initia… | |
| 19 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension uses 'chrome.tabCapture.capture({audio:true,video:false})' to capture a live audio stream from the active tab. While advertised as a volume-amplification feature, this grants the extension a full real-ti… | |
| 20 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension calls chrome.tabCapture.capture to acquire a live audio MediaStream from any tab, storing it in an in-memory map keyed by tab ID. While volume amplification is the stated purpose, the raw MediaStream is … | |
| 21 | Unauthorized Data Collection | high | js/background.js (line 1) | The background script calls `chrome.tabCapture.capture({audio: true, video: false})` to capture the active tab's audio stream, then stores the raw `MediaStream` reference indefinitely in a global `i` map alongside the… | |
| 22 | Code Injection | medium | js/background.js (line 1) | On installation, the background script queries every currently open browser tab (no URL filter) and programmatically injects `js/content.js` into all frames of each tab via `tabs.executeScript`. This bypasses the norm… | |
| 23 | Other | medium | html/popup.html (line 1) | The popup HTML declares no Content Security Policy via meta tag or HTTP header. Without a CSP, inline scripts and connections to arbitrary external origins are unrestricted in the popup context. Combined with the jQue… | |
| 24 | Privilege Escalation | medium | js/background.js (line 1) | The background message listener dispatches on 'action' values without validating or authenticating the origin of the sender. The 'setData' action writes volume and scope settings to storage and triggers tab audio capt… | |
| 25 | Privilege Escalation | medium | js/popup.js (line 1) | On popup open, the code sends an 'invoke' action to the background before retrieving settings with 'getData'. The purpose of 'invoke' is opaque due to obfuscation and, given the extension holds 'tabCapture' and '<all_… | |
| 26 | Privilege Escalation | medium | js/content.js (line 1) | The content script runs at `document_start` on all URLs with `all_frames` and `match_about_blank`, executing in every frame of every page the user visits — including sensitive pages such as banking and identity provid… | |
| 27 | Tracking | medium | js/background.js (line 1) | On installation the extension opens a tab to 'https://ladnet.co/<extensionId>/thanks.html' and registers an uninstall callback to 'https://ladnet.co/<extensionId>/uninstall.html'. Both URLs transmit the unique extensi… | |
| 28 | Tracking | medium | js/background.js (line 1) | The 'getData' action extracts and returns the hostname of the currently active tab and looks it up in a 'websites' storage object keyed by hostname. This means the extension accumulates and exposes a per-hostname hist… | |
| 29 | Tracking | medium | js/background.js (line 1) | On installation the extension forces a new tab to ladnet.co with the extension's runtime ID embedded in the URL path, and registers the same domain as the uninstall callback URL. This allows ladnet.co to record every … | |
| 30 | Tracking | medium | js/background.js (line 1) | The extension generates a persistent UUID client ID stored in chrome.storage.local as 'cid' and sends a Google Analytics pageview hit (UA-201292818-1) to https://www.google-analytics.com/collect every time the backgro… | |
| 31 | Unauthorized Data Collection | medium | js/background.js (line 1) | A UUID v4 is generated and permanently stored in chrome.storage.local as a persistent user identifier (cid). This ID is used in Google Analytics hits and potentially in requests to ladnet.co, effectively fingerprintin… | |
| 32 | Unauthorized Data Collection | medium | js/background.js (line 1) | The background script continuously queries the active tab's full URL via `tabs.query` and extracts the hostname using `getRootUrl`, storing it in a persistent `websites` object keyed by origin in `chrome.storage.local… | |
| 33 | Unauthorized Data Collection | medium | js/background.js (line 1) | The `p()` function enumerates every open browser tab with no URL or origin filter and broadcasts a message to all of them on volume changes. Combined with the `<all_urls>` host permission and `tabCapture`, this gives … | |
| 34 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension captures the full raw audio MediaStream from any browser tab using `chrome.tabCapture.capture({audio:true, video:false})` and holds a live reference to the stream object in the in-memory map `i[tabId]`. … | |
| 35 | Code Injection | low | js/content.js (line 1) | The content script injects a UI overlay into every page using 'innerHTML' with a template literal that embeds the volume value ('zP') obtained from 'browser.runtime.sendMessage({action:"getVolume"})'. While the value … | |
| 36 | Code Injection | low | js/content.js (line 1) | The content script sets `innerHTML` of a dynamically created `div` using a template literal that directly interpolates the volume value `r` received from the background via `runtime.sendMessage`. The value originates … | |
| 37 | Code Injection | low | js/content.js (line 1) | The content script interpolates a value received from `runtime.sendMessage` directly into `innerHTML` without sanitization. While the value is currently a numeric volume percentage, the absence of sanitization means a… | |
| 38 | Other | low | manifest.json (line 1) | The content script is declared with `run_at: "document_start"`, `all_frames: true`, and `match_about_blank: true`, meaning it executes in every frame of every HTTP/HTTPS page before the DOM is even constructed. Combin… | |
