| 1 | Privilege Escalation | critical | js/background.js (line 1) | On first installation, the background script immediately queries ALL currently open tabs and programmatically injects `js/content.js` into every tab and every frame via `allFrames:true`, bypassing normal manifest-decl… | |
| 2 | Other | high | js/popup.js (line 3) | The popup sends a message with `{action:"invoke"}` to the background script every time the popup is opened, but the background.js message handler only defines cases for 'getData', 'setData', and 'getVolume' — 'invoke'… | |
| 3 | Privilege Escalation | high | js/background.js (line 1) | On installation, the extension calls tabs.query({}) to enumerate all currently open tabs and injects content.js into every one via tabs.executeScript with allFrames:true and no URL filtering. This grants immediate scr… | |
| 4 | Tracking | high | js/background.js (line 18) | The analytics module generates a persistent unique client ID (UUID stored in chrome.storage.local under 'cid') and sends it to Google Analytics via the legacy Measurement Protocol endpoint (`https://www.google-analyti… | |
| 5 | Tracking | high | js/background.js (line 1) | The extension silently generates a persistent UUID (stored as 'cid' in chrome.storage.local) and sends a Google Analytics UA pageview hit to 'https://www.google-analytics.com/collect' on every background script startu… | |
| 6 | Unauthorized Data Collection | high | js/background.js (line 1) | The background script calls `chrome.tabCapture.capture({audio:true, video:false})` to capture the live audio stream of the active browser tab. The captured MediaStream is stored in the `kA` map keyed by tab ID and is … | |
| 7 | Unauthorized Data Collection | high | js/background.js (line 1) | The analytics function is called unconditionally at module load time with the hardcoded Google Analytics tracking ID UA-198799345-1, meaning the telemetry beacon fires every time the background service worker initiali… | |
| 8 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension uses chrome.tabCapture.capture({audio:true, video:false}) to acquire a live MediaStream from the active tab's audio output. While advertised as a volume-boosting feature, tabCapture gives the extension a… | |
| 9 | Unauthorized Data Collection | high | js/background.js (line 1) | The extension uses chrome.tabCapture.capture to capture the raw audio MediaStream of any tab and stores the live stream object in a global map keyed by tab ID. While nominally for volume boosting, the captured MediaSt… | |
| 10 | Code Injection | medium | js/content.js (line 1) | The content script assigns a value received from the background script directly into `innerHTML` of a host-page DOM element via `document.getElementById(Bi).innerHTML = \`${KF}%\``. While the volume value is expected … | |
| 11 | Code Injection | medium | js/content.js (line 1) | The `Dh` function constructs a DOM overlay element in the host page using `innerHTML` with a template literal that embeds the `JG` variable (volume value from background message) and `Bi` (derived from `chrome.runtime… | |
| 12 | Code Injection | medium | js/background.js (line 1) | On first install, the background script enumerates all currently open tabs (tabs.query({})) and programmatically injects content.js into every frame of every tab using executeScript with allFrames:true. This means the… | |
| 13 | Code Injection | medium | manifest.json (line 1) | The content script is configured to execute at document_start (before any DOM is constructed) in all HTTP/HTTPS frames including about:blank frames. Running at document_start in all_frames with match_about_blank:true … | |
| 14 | Obfuscation | medium | js/popup.js (line 1) | The entire popup.js (110 KB) is a heavily obfuscated browserify bundle where all meaningful variable names have been replaced with short nonsensical identifiers (Xg, JG, nz, Tp, Bi, KF) throughout. This level of obfus… | |
| 15 | Other | medium | js/background.js (line 1) | The background message listener dispatches on `action` values from content scripts without verifying the sender's origin or extension ID. The `setData` action triggers `qf()` which calls `chrome.tabCapture.capture()` … | |
| 16 | Tracking | medium | js/popup.js (line 3) | The helper module exports a `getRootUrl` function that extracts the hostname from URLs, which is used in background.js to extract hostnames from tab URLs and scope storage keys per site. Combined with the `<all_urls>`… | |
| 17 | Tracking | medium | js/background.js (line 1) | The extension generates a persistent UUID client identifier stored in chrome.storage.local as 'cid' and sends a Google Analytics pageview hit to https://www.google-analytics.com/collect on every background page load u… | |
| 18 | Tracking | medium | js/background.js (line 1) | The Google Analytics tracking beacon a.default('UA-198799345-1') fires unconditionally on every background script load — meaning every browser startup silently reports to Google's analytics servers with the persistent… | |
| 19 | Unauthorized Data Collection | medium | js/background.js (line 1) | The extension reads the URL of the active tab and extracts its hostname, then stores this in chrome.storage.local under a 'websites' key as a per-site volume settings map. This creates a persistent record of hostnames… | |
| 20 | Code Injection | low | js/content.js (line 1) | The content script assigns to innerHTML using a template literal that interpolates a value received from the background page via sendMessage. While the volume value is numeric and not directly user-controlled, constru… | |
| 21 | Other | low | html/popup.html (line 1) | The popup HTML contains no Content-Security-Policy meta tag, leaving the popup vulnerable to script injection if any variable is written to innerHTML without sanitization. The popup loads a 152 KB Bootstrap CSS bundle… | |
| 22 | Unauthorized Data Collection | low | js/background.js (line 1) | Every time the volume is adjusted, the background enumerates all open tabs (tabs.query({})) and sends a message to every one of them. This behavior is not scoped to only tabs where the extension has been activated — i… | |
