| 1 | Network Interception | critical | data/worker.js (line 1) | After activation, the extension monitors all tab navigations via `chrome.tabs.onUpdated` looking for Bing and Google search URLs, then silently redirects Bing searches to Google by extracting the `q` query parameter a… | |
| 2 | Network Interception | critical | data/worker.js (line 1) | The background worker registers a webRequest.onHeadersReceived listener intercepting ALL HTTP and HTTPS responses across every URL ('*://*/*') in blocking mode with full responseHeaders access. While it currently copi… | |
| 3 | Network Interception | critical | data/worker.js (line 1) | The background script registers a blocking webRequest listener on ALL URLs ('*://*/*') that intercepts every HTTP response's headers across every website. The listener copies all response headers into a new array and … | |
| 4 | Obfuscation | critical | data/worker.js (line 1) | All external URLs are stored as base64-encoded strings and decoded at runtime via an internal `l()` method wrapping `atob()` — a classic obfuscation technique to evade static URL scanning. The extension contacts `http… | |
| 5 | Obfuscation | critical | data/bg.js (line 1) | `bg.js` is an obfuscated/minified duplicate of `worker.js` containing the identical C2 communication logic: base64-encoded URL for `https://boostervl.com`, remote rule fetching via POST, and `declarativeNetRequest` ru… | |
| 6 | Other | critical | data/worker.js (line 1) | The extension implements a time-delayed activation mechanism: a repeating 30-minute alarm accumulates elapsed browser-use time in `chrome.storage.local`, and the malicious payload (C2 contact and rule injection) only … | |
| 7 | Phishing | critical | data/search.js (line 1) | On Bing search pages, `search.js` injects a fake Google logo SVG into the Bing search bar, hides Bing's native UI elements via `display:none`, and overlays white `div` elements with `z-index:100` to visually mask Bing… | |
| 8 | Remote Code Loading | critical | data/worker.js (line 1) | The extension fetches a `rules` array from the remote server at `https://boostervl.com` and immediately installs those rules as dynamic `declarativeNetRequest` rules via `chrome.declarativeNetRequest.updateDynamicRule… | |
| 9 | Remote Code Loading | critical | data/popup.js (line 1) | The extension contains a full notification/ad-injection system that references a global 'NOTIFICATIONS' variable nowhere defined in any shipped file. The system filters notifications by date range (dateFrom/dateTo), d… | |
| 10 | Code Injection | high | data/popup.js (line 1) | Notification title and message content from the `NOTIFICATIONS` global are written directly into the DOM via `innerHTML` without any sanitization. If the `NOTIFICATIONS` data source is ever remotely provided or manipu… | |
| 11 | Code Injection | high | popup.html (line 1) | A file named 'inject.js' is loaded in the privileged extension popup context but is NOT declared as a content_script in manifest.json, obscuring its role. Loading a file with injection-implying semantics in the privil… | |
| 12 | Code Injection | high | data/popup.js (line 1) | The showNotification method writes notification title and message content directly to innerHTML without sanitization. The NOTIFICATIONS data source is not defined in this file, meaning it could be injected from a remo… | |
| 13 | Code Injection | high | data/popup.js (line 1) | Notification title and message content are injected into the DOM via innerHTML rather than textContent, creating an HTML injection sink. If the NOTIFICATIONS data (sourced from storage or another script) contains HTML… | |
| 14 | Code Injection | high | data/libs/inject.js (line 1) | This file invokes $.switcher() via a jQuery document-ready wrapper but is not declared in the manifest's content_scripts or background scripts — it has no legitimate load path. Its presence alongside a custom jQuery p… | |
| 15 | Obfuscation | high | data/rangeСurrent.js (line 1) | The filename 'rangeСurrent.js' contains a Cyrillic Unicode homoglyph character (С = U+0421) substituted for the visually identical Latin 'C' (U+0043), a deliberate obfuscation technique used to evade static analysis t… | |
| 16 | Obfuscation | high | popup.html (line 1) | The script filename 'rangeСurrent.js' contains a Cyrillic Unicode character U+0421 (С) in place of the Latin 'C' — a homoglyph substitution deliberately chosen to evade file-pattern-based security scanning tools. Legi… | |
| 17 | Obfuscation | high | data/rangeСurrent.js (line 1) | The filename itself uses a Cyrillic homoglyph (U+0421) substituted for the Latin 'C', a deliberate obfuscation technique to evade detection tools. The code also uses innerHTML to inject the volume percentage value fro… | |
| 18 | Obfuscation | high | data/rangeСurrent.js (line 1) | The filename 'rangeСurrent.js' uses a Cyrillic 'С' (U+0421) instead of the Latin 'C' (U+0043), making it appear as 'rangeCurrent.js' to casual inspection. This homoglyph substitution is a classic obfuscation technique… | |
| 19 | Other | high | popup.html (line 1) | The popup's <title> tag reads 'Domain Blocker' while the extension is marketed as 'Volume Booster — Amplifier' — a significant identity mismatch indicating this extension was repackaged from a different, likely purpos… | |
| 20 | Privilege Escalation | high | data/worker.js (line 1) | By returning modified responseHeaders from the blocking listener on all URLs, the extension can silently strip CSP, CORS, or X-Frame-Options headers from any website response the user receives. Removing these headers … | |
| 21 | Remote Code Loading | high | data/popup.js (line 1) | The notification system references a globally-scoped `NOTIFICATIONS` variable not defined in this file, suggesting it is loaded from an external or dynamically injected script. The filter logic uses `minDaysFromInstal… | |
| 22 | Tracking | high | data/search.js (line 1) | The extension injects a hidden `<input name='q_type' value='1'>` field into the Bing search form on every page load. This covert parameter is appended to all searches submitted through the tampered form, allowing the … | |
| 23 | Unauthorized Data Collection | high | data/worker.js (line 1) | The extension transmits the unique `chrome.runtime.id` and the current activation state (`idle` flag) to the remote C2 server at `https://boostervl.com` on every trigger. This allows the server operator to track indiv… | |
| 24 | Unauthorized Data Collection | high | data/worker.js (line 1) | The extension captures the active tab's full audio stream via chrome.tabCapture.capture() and routes it through an AudioContext gain node retained in tabsData. While volume amplification is the stated purpose, the Med… | |
| 25 | Unauthorized Data Collection | high | data/popup.js (line 1) | The extension records and persists an installationDate, then uses it alongside time-window filters (dateFrom, dateTo, minDaysFromInstallation) in getCurrentNotification() to selectively trigger notifications after a d… | |
| 26 | Code Injection | medium | data/visualize.js (line 1) | The content script injected into all URLs appends a DOM element directly into every webpage's body. While the injected HTML appears static, this establishes a persistent DOM foothold on every page the user visits, inc… | |
| 27 | Obfuscation | medium | popup.html (line 1) | The HTML title tag reads 'Domain Blocker' while the extension presents itself as 'Volume Booster' — a clear identity mismatch indicating this is a repackaged or repurposed extension. This pattern is common in maliciou… | |
| 28 | Other | medium | data/search.js (line 1) | The `search.js` content script checks for the presence of a `cvid` query parameter (Bing's internal click-tracking/session ID) before activating its UI spoofing — if `cvid` is detected, it aborts entirely. This consti… | |
| 29 | Other | medium | data/libs/inject.js (line 1) | Despite its strongly injection-implying name, inject.js contains only a jQuery document-ready call to $.switcher(), a UI toggle plugin. The deceptive naming — combined with the fact that this file is not declared in t… | |
| 30 | Other | medium | data/libs/jquery.switcher.js (line 1) | The toggleSwitch handler is assigned without a declaration keyword (var/let/const), creating an implicit global variable accessible and overwritable by any script in the same page context. Since this plugin runs on al… | |
| 31 | Privilege Escalation | medium | manifest.json (line 25) | The extension injects jQuery (a full third-party library, 87KB) and a custom visualize.js content script into every single web page the user visits via '<all_urls>'. The combination of broad host permissions and a per… | |
| 32 | Tracking | medium | data/popup.js (line 1) | The extension persists an `installationDate` timestamp and tracks which notification IDs the user has seen/dismissed (`usedIds`) in `chrome.storage.local`. This constitutes a persistent user-tracking profile tied to i… | |
| 33 | Tracking | medium | popup.html (line 1) | The popup loads a Google Fonts stylesheet from `fonts.googleapis.com`, causing an outbound network request to Google's servers every time the popup opens — allowing correlation of popup-open events with user IP addres… | |
| 34 | Tracking | medium | popup.html (line 1) | The popup loads a font from an external Google Fonts URL, causing a network request to a third-party server every time the extension popup is opened. While Google Fonts itself is not malicious, this external dependenc… | |
| 35 | Tracking | medium | data/worker.js (line 1) | The background script listens to chrome.tabs.onRemoved to track the complete tab lifecycle across all browser tabs. Combined with tabsData storing per-tab audio capture state, the extension maintains comprehensive rea… | |
| 36 | Unauthorized Data Collection | medium | popup.html (line 1) | The extension popup loads a CSS stylesheet from an external Google Fonts URL. Every time the user opens the volume booster popup, a network request is made to Google's servers, leaking the fact that the user opened th… | |
| 37 | Tracking | low | popup.html (line 1) | The popup loads a stylesheet from an external Google Fonts server rather than bundling fonts locally, causing an outbound network request to a third-party server every time the popup is opened. This leaks usage teleme… | |
