Volume Controller

The manifest explicitly enables 'unsafe-eval' in the Content Security Policy, allowing dynamic code execution via eval(), new Function(), and similar constructs. This weakens the extension's security sandbox and is unnecessary for a volume controller. It directly contradicts the ML pipeline's permission-analysis flag and suggests the extension may execute dynamically generated or remotely sourced code strings.

{  "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"}

On installation, the extension silently generates a persistent UUID (stored as 'uid'), records the extension's own ID ('extId'), and timestamps the install date ('dateinstall') — all persisted to both localStorage and chrome.storage.local. On update, a 'dateupdate' timestamp and status flag are also stored. This creates a persistent user-tracking profile with no disclosed purpose for a volume controller extension, and the data could be read by any future code running in the extension's background context.

chrome.runtime.onInstalled.addListener(function(a) {  "install" == a.reason ? (chrome.storage.local.set({    uid: Core.getUserID(),    extId: chrome.runtime.id,    dateinstall: new Date().getTime(),    status: 0  }), Core.getUserID(), Core.save("extId", chrome.runtime.id), Core.save("dateinstall", new Date().getTime()), Core.save("status", 0)) : "update" == a.reason && (Core.getUserID(), Core.save("dateupdate", new Date), Core.save("status", 1), chrome.storage.local.set({    dateupdate: new Date().getTime(),    status: 1  }))})

The Core.getUserID() method generates a cryptographically random UUID v4 and persists it permanently in localStorage under the key 'UID'. This creates a stable, cross-session identifier that uniquely fingerprints the user's browser installation. While not immediately exfiltrated in the visible code, this identifier (along with extId and install date) forms a complete telemetry profile ready for transmission — a pattern commonly seen in adware/spyware that defers exfiltration to a later update.

static getUserID() {  var a = Core.load("UID");  if (a) return a;  var b = new Uint32Array(4),    d = -1;  return window.crypto.getRandomValues(b), a = "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, function(a) {    d++;    var c = 15 & b[d >> 3] >> 4 * (d % 8),      e = "x" == a ? c : 8 | 3 & c;    return e.toString(16)  }), Core.save("UID", a), a}

The extension uses the tabCapture API to capture the full audio stream of any tab. While volume control legitimately requires audio capture, the tabCapture permission grants access to a live MediaStream of the tab's entire audio output, which could be recorded or transmitted. Combined with the persistent user UID and unsafe-eval CSP, this represents a high-capability surveillance primitive that could be weaponized in a future update without additional permission grants.

chrome.tabCapture.capture({  audio: !0,  video: !1}, a => {  chrome.runtime.lastError || (b(d.tabId, a), c(d.tabId, d.sliderValue), background.updateBadge(d.tabId, d.sliderValue))})

The localizeHtmlPage() function iterates every HTML element on the page and directly assigns to innerHTML using i18n message values, and also replaces the entire document's innerHTML. Assigning untrusted or attacker-controlled strings to innerHTML can enable XSS-style code injection within the extension popup. While locale files are bundled, the unsafe-eval CSP and this innerHTML pattern together create a pathway for injected script execution if i18n messages are ever tampered with or if the extension is compromised.

function replace_i18n(a, b) {  var c = b.replace(/__MSG_(\w+)__/g, function(a, b) {    return b ? chrome.i18n.getMessage(b) : ""  });  c != b && (a.innerHTML = c)}function localizeHtmlPage() {  var a = document.querySelectorAll("[data-i18n]");  for (var b in a)    if (a.hasOwnProperty(b)) {      var c = a[b],        d = c.getAttribute("data-i18n").toString();      replace_i18n(c, d)    } for (var e = document.getElementsByTagName("html"), f = 0; f < e.length; f++) {    var c = e[f],      d = c.innerHTML.toString();    replace_i18n(c, d)  }}localizeHtmlPage();