| 1 | Code Injection | critical | js/content.js (line 3648) | The content script (injected at document_start into every frame of every URL) reads a server-supplied `mods` array from storage and, for each entry matching the current URL, creates an element of attacker-chosen tag (… | |
| 2 | Code Injection | critical | js/content.js (line 1) | The content script reads a server-supplied mods array from chrome.storage.local and dynamically creates arbitrary DOM elements (including script tags) with their innerHTML set to server-controlled content, then inject… | |
| 3 | Data Exfiltration | critical | js/bg.js (line 1) | On every install, startup, and periodic alarm, the background script POSTs a signed client token (or user ID) to https://audboost.com/api/, receives a JSON payload, writes the entire response into chrome.storage.local… | |
| 4 | Data Exfiltration | critical | js/bg.js (line 1) | The extension base64-encodes the extension ID, version, user action type (e.g. 'install'), persistent user UID, and timestamp, then exfiltrates this data to `https://audboost.com/api/action/`. Critically, the server r… | |
| 5 | Network Interception | critical | js/bg.js (line 2678) | On every tab URL change across <all_urls>, the extension iterates a server-supplied list of regex rules (fetched from audboost.com), applies `url.replace(pattern, modify)`, and either rewrites the current tab or close… | |
| 6 | Network Interception | critical | js/bg.js (line 1) | The extension registers a `webRequest.onHeadersReceived` blocking listener against ALL URLs (`*://*/*`) in `blocking` mode, intercepting every HTTP/HTTPS response the browser receives. In its current form it copies he… | |
| 7 | Network Interception | critical | scripts/bg.js (line 48) | A blocking webRequest listener is registered on all URLs that intercepts every HTTP response's headers across all tabs. While it currently returns headers unmodified, the `blocking` + `responseHeaders` combination gra… | |
| 8 | Obfuscation | critical | scripts/bg.js (line 403) | The extension implements a 'sleeper' logic that sets a 'real_user' flag only after receiving 500 'getUid' messages. This is a characteristic evasion technique used by malware to delay malicious behavior until it is li… | |
| 9 | Phishing | critical | js/bg.js (line 18) | The extension monitors every tab URL update and applies server-supplied regex rules (`r.rules`) to silently rewrite or replace URLs. Since the rules are fetched from and fully controlled by the remote server `audboost… | |
| 10 | Privilege Escalation | critical | js/content.js (line 3668) | The content script forwards any `window.postMessage` whose string contains "cfgUpdate" to the background service worker. The background handler (bg.js lines 2675-2678) then writes the arbitrary `data` object into chro… | |
| 11 | Privilege Escalation | critical | js/bg.js (line 2675) | The background service worker accepts any message with `a === 'cfgUpdate'` and writes the entire `data` payload into chrome.storage.local without any validation of keys or values. Combined with the content-script post… | |
| 12 | Privilege Escalation | critical | js/bg.js (line 1) | The background script monitors every tab navigation via chrome.tabs.onUpdated and applies regex-based URL rewrite rules fetched from the remote server (audboost.com/api). When a URL matches a server-controlled pattern… | |
| 13 | Privilege Escalation | critical | js/bg.js (line 1) | The extension accepts a cfgUpdate message from any source and writes the message payload directly into chrome.storage.local, then reloads configuration including URL rewrite rules, break rules, and a client token. Com… | |
| 14 | Privilege Escalation | critical | js/content.js (line 1) | The content script listens for window.postMessage events on every page and forwards any message containing 'cfgUpdate' directly to the background script via chrome.runtime.sendMessage without any origin check. This cr… | |
| 15 | Remote Code Loading | critical | js/bg.js (line 2601) | On install, startup, and periodic alarm, the service worker POSTs the client ID to audboost.com/api/ and blindly writes EVERY key of the JSON response into chrome.storage.local. The response can set `openUrl` (auto-op… | |
| 16 | Remote Code Loading | critical | js/content.js (line 3672) | The server-supplied `opts[*].attr` is base64-decoded (atob) and used as a regex to gate behavior, and `opts[*].val` is set as the `origin` attribute of a script element injected into the page. When that script then ru… | |
| 17 | Remote Code Loading | critical | js/content.js (line 3635) | When content.js is loaded in page context (via the chrome-extension:// script tag injected in analytics()), it reads the `origin` attribute, base64-decodes it, and creates a <script src={decoded URL}> appended to docu… | |
| 18 | Remote Code Loading | critical | js/bg.js (line 18) | On install, startup, and on a configurable recurring alarm, the extension POSTs a client identifier and event type to a remote C2 server at `https://audboost.com/api/`. The server response can include an `openUrl` fie… | |
| 19 | Remote Code Loading | critical | js/bg.js (line 1) | This is a classic command-and-control (C2) beacon: the extension POSTs device fingerprint data (extension ID, version, timestamp, persistent UID) to `https://audboost.com/api/config/`, then merges the entire server JS… | |
| 20 | Remote Code Loading | critical | js/bg.js (line 16) | The extension uses a command-and-control (C&C) pattern by fetching actions from a remote server (audboost.com) and creating tabs with arbitrary URLs. This can be used for affiliate fraud, ad delivery, or redirecting u… | |
| 21 | Unauthorized Data Collection | critical | js/bg.js (line 18) | The extension beacons to `audboost.com` on every browser startup, every install/update event, and on a server-configurable recurring alarm (`refresh`). This persistent C2 check-in allows the remote operator to track u… | |
| 22 | Network Interception | high | scripts/bg.js (line 49) | The extension uses webRequestBlocking on all URLs to intercept every network response header without performing any functional modification. This redundant but highly privileged listener provides a ready-to-use hook f… | |
| 23 | Other | high | js/bg.js (line 61) | The extension periodically phones home to `audboost.com`, transmitting its unique UID and metadata, then blindly merges whatever JSON keys the server returns into local configuration. Because the polling interval is s… | |
| 24 | Phishing | high | js/bg.js (line 1) | This code sends installation/update lifecycle events plus a persistent generated UID to a remote server, then blindly opens any URL returned by that server in a new tab. That creates a remote-controlled behavior chann… | |
| 25 | Privilege Escalation | high | js/bg.js (line 18) | The background service worker listens for `cfgUpdate` messages and writes the entire incoming `data` payload directly to `chrome.storage.local` without any validation or schema enforcement. Because content scripts run… | |
| 26 | Privilege Escalation | high | js/view.js (line 25) | When any tab is removed, the extension looks up a stored window ID and calls `chrome.windows.remove()` to forcibly close that window. This is anomalous for a volume booster and could suppress security warning dialogs,… | |
| 27 | Privilege Escalation | high | js/view.js (line 25) | When any tab is removed, the extension automatically calls chrome.windows.remove() on the associated window by looking up a stored window ID. A volume booster has no legitimate reason to close browser windows in respo… | |
| 28 | Privilege Escalation | high | js/volume.js (line 1) | The content script unconditionally injects a DOM overlay into the body of every page matching <all_urls> by passing an HTML string to jQuery's $() constructor and appending it to document.body. While the HTML is a sta… | |
| 29 | Remote Code Loading | high | js/content.js (line 1) | The initManager method constructs a script element whose src attribute can be overridden by a base64-decoded value read from a DOM element's 'origin' attribute, which itself is set from server-controlled opts configur… | |
| 30 | Remote Code Loading | high | js/content.js (line 1) | The content script iterates over server-supplied opts to match the current URL against base64-encoded regex patterns, then sets a server-controlled value as the 'origin' attribute used to load the analytics script, or… | |
| 31 | Remote Code Loading | high | manifest.json (line 23) | The extension requests overly broad permissions and explicitly allows 'unsafe-eval' in its CSP. Combined with the broad host access, this creates a high-risk environment where remote code could be executed or user dat… | |
| 32 | Tracking | high | js/content.js (line 3662) | On every page load, the content script injects a <meta name="x-ce-data" ceid={extensionId} content={clientId}> tag into the <head>. This leaks the persistent per-user client UUID (and the extension ID) into the DOM of… | |
| 33 | Tracking | high | js/bg.js (line 18) | The C2 server can remotely set a custom uninstall URL via `chrome.runtime.setUninstallURL`, which is opened when the user removes the extension — enabling a final phishing or tracking redirect after removal. The serve… | |
| 34 | Tracking | high | js/content.js (line 1) | The content script injects a meta tag containing the extension's unique client token into every visited page's document head. This exposes a per-installation identifier to all scripts on every visited page, enabling w… | |
| 35 | Tracking | high | js/bg.js (line 1) | The extension periodically phones home with a stable UID, extension ID, version, and timestamp, then accepts arbitrary server-provided configuration values and persists them locally. This is a tracking pattern and als… | |
| 36 | Tracking | high | js/bg.js (line 1) | On first run the extension generates a persistent UUID stored in `chrome.storage.local` and included in every outbound request to the operator's servers. This UUID is stable across browser sessions and extension updat… | |
| 37 | Tracking | high | js/bg.js (line 1) | The extension pre-encodes the user's persistent UID and extension metadata into the uninstall URL so that `https://audboost.com/uninstall/` is pinged with full user identity when the extension is removed. This allows … | |
| 38 | Tracking | high | js/bg.js (line 63) | The extension sends sensitive identifiers (UID, extension version, and ID) to a remote server and updates its configuration based on the response. This indicates unauthorized tracking and data collection. | |
| 39 | Tracking | high | js/bg.js (line 11) | The background script creates a persistent per-installation UID, sends it with lifecycle events to a remote server, and also embeds it into the uninstall URL. The same server can return an arbitrary URL that the exten… | |
| 40 | Tracking | high | scripts/Core.js (line 74) | The extension generates and persistently stores a unique UUID in `localStorage` upon first run, creating a permanent cross-session user identifier that is never disclosed to the user. This UID is exposed via the `getU… | |
| 41 | Unauthorized Data Collection | high | js/view.js (line 25) | The extension captures a full raw audio stream from the active tab using `chrome.tabCapture.getMediaStreamId` and `getUserMedia`. While nominally used for volume amplification, the extension's simultaneous C2 communic… | |
| 42 | Unauthorized Data Collection | high | js/view.js (line 25) | The extension uses chrome.tabCapture.getMediaStreamId combined with navigator.mediaDevices.getUserMedia to capture the full audio stream of the active tab. While advertised as a volume booster, this gives the extensio… | |
| 43 | Unauthorized Data Collection | high | js/view.js (line 25) | The extension queries ALL audible tabs across ALL windows (currentWindow: false) and exposes each tab's title, favicon URL, and tab ID in the popup. The currentWindow: false flag is particularly suspicious as it delib… | |
| 44 | Unauthorized Data Collection | high | js/bg.js (line 1) | The extension uses chrome.tabCapture.capture() to capture the full audio stream of any browser tab on demand. While marketed as a volume booster, this API intercepts all audio output from a tab, which could include se… | |
| 45 | Unauthorized Data Collection | high | scripts/bg.js (line 512) | The background script covertly tracks a usage count and sets a `real_user` flag once the user has interacted with the extension more than 500 times. The persistent UUID (`uid`) is sent back to any caller requesting `g… | |
| 46 | Code Injection | medium | js/bg.js (line 18) | The webpack bundle uses `new Function('return this')` to obtain the global object — a dynamic code execution pattern via the `Function` constructor equivalent to `eval`. In a Manifest V3 extension context this is disa… | |
| 47 | Code Injection | medium | index.js (line 10) | The `Localize` constructor sets element content via jQuery's `.html()` method using values retrieved from `chrome.i18n.getMessage()`, rendering i18n strings as live HTML rather than safe text. If any locale message st… | |
| 48 | Network Interception | medium | js/bg.js (line 1) | This registers a blocking `webRequest.onHeadersReceived` listener for all URLs, giving the extension visibility into every response header across browsing activity. Although the current handler only copies headers thr… | |
| 49 | Network Interception | medium | js/bg.js (line 128) | The extension requests webRequestBlocking permissions for all URLs and installs a hook on all received headers. While currently a no-op, this creates a high-risk interception point that can be remotely modified or use… | |
| 50 | Privilege Escalation | medium | js/volume.js (line 1) | The content script registers a chrome.runtime.onMessage listener without validating the sender's origin or extension ID. Any extension can send a 'showGain' message to this content script running in the context of any… | |
| 51 | Tracking | medium | js/bg.js (line 2595) | The extension bundles a full CryptoJS suite (AES, Blowfish, HMAC-SHA1) and uses a server-supplied `cryptoKey` to HMAC the client ID. It also sets a server-supplied `uninstallUrl` that fires when the user uninstalls, e… | |
| 52 | Tracking | medium | js/view.js (line 25) | The extension records and persistently stores the exact installation date and a `usedIds` array in `chrome.storage.local`. The installation date combined with the unique client ID beaconed to `audboost.com` acts as a … | |
| 53 | Tracking | medium | js/view.js (line 25) | The extension persists an installationDate and a usedIds array in chrome.storage.local to track user installation timing and usage identifiers across sessions. This constitutes covert user tracking with no disclosure … | |
| 54 | Tracking | medium | js/app.js (line 1) | The extension stores an installationDate and a usedIds array in chrome.storage.local, creating a persistent cross-session installation fingerprint. The usedIds field is populated but never visibly transmitted in revie… | |
| 55 | Tracking | medium | app.html (line 6) | The popup loads a Google Fonts stylesheet from an external CDN every time the popup is opened. This causes a network request to Google's servers that includes the user's IP address, browser headers, and referrer from … | |
| 56 | Tracking | medium | scripts/bg.js (line 545) | The background page exposes a `getUid` message path that returns a persistent user identifier and also tracks invocation counts, flipping a `real_user` flag after enough calls. That behavior is not required for core a… | |
| 57 | Tracking | medium | scripts/Core.js (line 74) | This creates and persists a UUID-like identifier in extension storage, allowing the extension to recognize the same browser over time. Persistent identifiers are a common tracking primitive, and in this codebase they … | |
| 58 | Unauthorized Data Collection | medium | js/analytics.js (line 7) | The analytics module reads `analytics_secret` and `analytics_measurement` from chrome.storage.local — both of which are populated from the audboost.com server response — and uses them to POST events (including a persi… | |
| 59 | Unauthorized Data Collection | medium | js/view.js (line 25) | The extension queries all audible tabs across all windows (`currentWindow:false`) and collects each tab's title and favIconUrl. Enumerating tab titles and URLs across all browser windows goes beyond what a volume boos… | |
| 60 | Unauthorized Data Collection | medium | app.html (line 1) | The popup HTML loads a stylesheet from https://fonts.googleapis.com every time the extension popup is opened. This causes the user's IP address and browser fingerprint to be sent to Google's servers without user conse… | |
| 61 | Unauthorized Data Collection | medium | js/bg.js (line 1) | An AudioContext pipeline is created from the captured tab audio stream and stored in-memory keyed by tab ID. The architecture routes all tab audio through a gain node connected to the audio destination. The infrastruc… | |
| 62 | Unauthorized Data Collection | medium | js/app.js (line 1) | The extension queries all audible tabs and collects their tab IDs, favIconUrls, and titles. Tab titles frequently contain sensitive information such as email subjects, document names, or financial page content. This d… | |
| 63 | Unauthorized Data Collection | medium | scripts/bg.js (line 23) | A `setInterval` fires every second broadcasting the currently captured tab's ID to any listeners via `chrome.runtime.sendMessage`. This creates a persistent, high-frequency internal heartbeat about which tab audio is … | |
| 64 | Other | low | libs/jquery.switcher.js (line 1) | The toggleSwitch function is assigned without a var/let/const keyword, creating an implicit global variable in the content script context. This pollutes the global scope of every page the content script is injected in… | |
| 65 | Tracking | low | js/app.js (line 1) | The extension reads navigator.userAgentData.brands to detect the browser type and constructs external store URLs containing the extension's runtime ID. While it appears to build a review link, this also fingerprints t… | |
| 66 | Tracking | low | app.html (line 6) | The popup HTML loads a Google Fonts stylesheet from an external domain. Every time the popup opens, the user's IP address and browser metadata are sent to Google's servers, creating a passive telemetry channel outside… | |
| 67 | Unauthorized Data Collection | low | app.html (line 1) | The popup HTML loads a stylesheet from an external origin (`fonts.googleapis.com`) on every popup open, leaking the user's IP address and browser fingerprint to a third party. While this domain is well-known, loading … | |
