| 1 | Data Exfiltration | critical | js/app.js (line 2009) | Class `I` orchestrates the telemetry: every 2 seconds (`a = 2e3`) it forwards captured raw mouse/keyboard/scroll/focus/click events together with the current page URL to the background service worker (`hd_score_behavi… | |
| 2 | Data Exfiltration | critical | js/app.js (line 2048) | Every 2 seconds the content script forwards the collected raw mouse/keyboard/scroll/focus event log together with the current `location.href` of the visited page to the background service worker via `hd_score_behavior… | |
| 3 | Tracking | critical | js/app.js (line 1067) | Class `x` (referenced as `hd_telemetry_v1`) builds a sweeping device/browser fingerprint: canvas hash + emoji glyph hash, audio-context hash, WebGL/WebGL2 vendor/renderer/extensions/parameters, GPU benchmark timings, … | |
| 4 | Tracking | critical | js/app.js (line 1069) | The class `x` (telemetry collector) builds a dense device fingerprint: canvas hash + glyph hash + emoji color ratio, audio fingerprint via OfflineAudioContext, WebGL/WebGL2 vendor+renderer with unmasked GPU info, inst… | |
| 5 | Unauthorized Data Collection | critical | js/app.js (line 475) | Class `l` is a generic behavioral-telemetry collector that hooks mousemove, mousedown/up, click, wheel, keydown/up, focus, blur and visibilitychange on every page the extension runs on (matches `*://*/*` at document_s… | |
| 6 | Unauthorized Data Collection | critical | js/app.js (line 477) | A content script injected on `<all_urls>` (run_at: document_start) instantiates a global event collector that captures mousemove/down/up/click, wheel/scroll, keydown/keyup (including the exact `key` and `code` of ever… | |
| 7 | Code Injection | high | js/app.js (line 88) | The `set-constant` scriptlet builds JavaScript by interpolating the value parameter `r` directly into a template literal with no validation or sanitization (only the property-path `t` is regex-checked). Whatever popul… | |
| 8 | Other | high | manifest.json (line 40) | The manifest declares a background service worker at ./js/bg.js but that file is absent from the analysis bundle. The service worker is the most privileged script in an MV3 extension (it owns webRequest/declarativeNet… | |
| 9 | Remote Code Loading | high | js/app.js (line 2080) | `H()` reads `cssSelectors.domainSelectors` from chrome.storage, then `O()` builds a JavaScript string from those entries and executes it in the page by appending a `<script>` whose `textContent` is concatenated, scrip… | |
| 10 | Remote Code Loading | high | js/app.js (line 2082) | The extension reads `cssSelectors.domainSelectors` from `chrome.storage.local`, builds JavaScript scriptlets (`set-constant`, `remove-attr`, `json-prune`, `nobab`) by string-interpolating the stored selector arguments… | |
| 11 | Remote Code Loading | high | js/app.js (line 249) | The extension reads a `cssSelectors` filter list from `chrome.storage.local`, parses uBlock-style `//scriptlet(...)` directives, builds JavaScript source strings by interpolating list-supplied parameters (`${t}`, `${n… | |
| 12 | Remote Code Loading | high | js/app.js (line 143) | Constructs a `<script>` element whose `textContent` is built from selector strings stored in `chrome.storage.local` and injects it into the page on every navigation (content script runs at `document_start` for `<all_u… | |
| 13 | Tracking | high | js/app.js (line 908) | A `LieDetector` (`d` class) probes for Puppeteer/Playwright/Selenium/Chromedriver indicators, native-function spoofing, descriptor/prototype tampering, taskbar/fullscreen ergonomics, and creates honeypot inputs and ti… | |
| 14 | Unauthorized Data Collection | high | js/app.js (line 1894) | Injects an invisible honeypot `<input name="website_url">` plus hidden timing-trap and DOM-reaction-trap elements into every page to catch automation tools, with `data-1p-ignore`/`data-lpignore`/`data-bwignore` to hid… | |
| 15 | Code Injection | medium | js/app.js (line 42) | The `manip` helper for the YouTube ad-skipper supports a `remove-run` action that calls `eval(func)` on a value taken from the actions array. Although the only call site currently passes the result of `playVid()` (i.e… | |
| 16 | Code Injection | medium | js/app.js (line 42) | The `manip` helper supports a `remove-run` action that calls `eval(func)` on a value supplied by the action descriptor. While the call site at line 142 currently passes `playVid()` (an in-bundle reference), this `eval… | |
| 17 | Code Injection | medium | js/app.js (line 42) | The content script's DOM-manipulation helper supports a 'remove-run' action that passes a `func` field to `eval()`. While the current callsite supplies a benign value, the dispatcher accepts arbitrary code from any ca… | |
| 18 | Code Injection | medium | js/app.js (line 249) | uBlock-style 'scriptlet' handlers build JavaScript strings by interpolating arguments parsed out of CSS selector entries fetched from chrome.storage.local ('cssSelectors'). The 'set-constant' handler interpolates the … | |
| 19 | Code Injection | medium | js/app.js (line 112) | Scriptlet templates interpolate user-controlled values from chrome.storage.local directly into JavaScript source strings. While the property/attribute names are regex-validated, the `set-constant` value `${o}` and `re… | |
| 20 | Code Injection | medium | js/app.js (line 142) | Dynamically constructs a <script> element whose textContent is generated from selectors loaded out of chrome.storage.local and injects it into the page DOM. The actual code text is templated (not free-form remote JS),… | |
| 21 | Code Injection | medium | js/app.js (line 157) | Builds JavaScript source strings from data read out of chrome.storage.local and interpolates user-controlled values directly into them. The `set-constant` handler does validate the property path (`t`) with a regex but… | |
| 22 | Credential Theft | medium | js/tw.js (line 998) | After overriding `window.fetch`, the script extracts the user's Twitch `Authorization` bearer token, `Client-Integrity` token, `Client-Session-Id`, `Client-Version`, and `X-Device-Id` headers from outbound requests an… | |
| 23 | Credential Theft | medium | js/tw.js (line 1001) | window.fetch is monkey-patched on twitch.tv pages to read Authorization, Client-Integrity, Client-Session-Id, Client-Version and Device-ID headers off every GraphQL request and forward them via postMessage to the inje… | |
| 24 | Network Interception | medium | js/tw.js (line 145) | The replacement Twitch Worker is constructed by string-templating credentials (Authorization, Client-Integrity, Client-Session, Device-Id) into source that ends with eval(workerString) where workerString is the body f… | |
| 25 | Other | medium | manifest.json (line 40) | The manifest declares ./js/bg.js as the MV3 service worker, but that file is not present in the analyzed bundle. The background script is the component that would handle webRequest, declarativeNetRequest, tabs, and po… | |
| 26 | Remote Code Loading | medium | js/tw.js (line 132) | The Twitch hook fetches Twitch's own worker JS via a synchronous XHR (`getWasmWorkerJs`), then `eval()`s the entire fetched worker source inside the page-injected Worker shell. Even though this targets twitch.tv's own… | |
| 27 | Remote Code Loading | medium | js/tw.js (line 233) | Inside a replacement `Worker` constructor injected into Twitch pages, the extension performs a synchronous XHR to fetch the original Twitch worker JS from a blob URL and then runs it via `eval(workerString)` inside th… | |
| 28 | Remote Code Loading | medium | js/app.js (line 277) | Dynamically generated scriptlet code is injected into every page by appending a <script> element whose textContent is built from chrome.storage data. This is the standard adblocker injection pattern, but combined with… | |
| 29 | Remote Code Loading | medium | js/tw.js (line 233) | Synchronous XHR fetches the original Twitch worker JavaScript body so it can be wrapped and re-evaluated. The fetch happens inside a same-origin context to twitch.tv blob URLs, but the response is then concatenated in… | |
| 30 | Remote Code Loading | medium | js/app.js (line 185) | The `r()` function injects a freshly-built <script> element into the page whose body is assembled from `cssSelectors.domainSelectors` entries kept in chrome.storage.local. Because the bundled background service worker… | |
| 31 | Remote Code Loading | medium | js/app.js (line 112) | Reads a `cssSelectors` payload from extension storage and applies per-domain rules including scriptlet code on every page load. The `bg.js` service worker referenced in `manifest.json` is not present in the analyzed b… | |
| 32 | Tracking | medium | js/app.js (line 2187) | Every content script (running on every page at document_start) opens a long-lived `keep-alive` port to the background service worker and reconnects every 295 s, ensuring the MV3 service worker never idle-shuts-down. C… | |
| 33 | Tracking | medium | js/app.js (line 1762) | The fingerprinting module spawns a Web Worker from a Blob URL whose only purpose is to read `navigator.userAgent`, `platform`, `language`, `hardwareConcurrency`, and `Intl` timezone from inside the worker context — a … | |
| 34 | Code Injection | low | js/tw.js (line 219) | The script monkey-patches `window.Worker`, `window.fetch`, `localStorage.getItem/setItem`, `document.visibilityState`, and `document.hidden` in the page world via a script tag injected by the content script (`app.js` … | |
| 35 | Code Injection | low | js/app.js (line 42) | Use of eval() to execute code from a 'func' field in an action descriptor. In the current call sites the value passed is the result of an internal function (e.g. playVid()), but the eval pattern itself is dangerous an… | |
| 36 | Code Injection | low | js/app.js (line 16) | Reassigns the entire `<html>` innerHTML after substituting `__MSG_*__` tokens with values from chrome.i18n.getMessage. The substituted strings come from extension-bundled `_locales` so the practical risk is limited, b… | |
| 37 | Network Interception | low | js/app.js (line 186) | Reads a per-domain CSS selector from chrome.storage.local (`cssSelectors.domainSelectors`) and uses it to hide arbitrary DOM elements on every site (host_permissions: <all_urls>). If the background service worker (ref… | |
| 38 | Obfuscation | low | js/app.js (line 20) | The internal logger `f` is short-circuited with an unconditional `return` on its first line followed by dead code. This silences all diagnostic output from the content script in production, reducing observability of t… | |
| 39 | Other | low | js/app.js (line 213) | Content script opens a recursive 295-second keep-alive port to the service worker to defeat MV3 worker idle suspension. Not malicious on its own and is a known MV3 workaround, but it does indicate the extension wants … | |
| 40 | Other | low | js/app.js (line 260) | Implements a persistent keep-alive loop that re-opens a runtime port every 295 seconds to defeat Chrome's MV3 service-worker idle suspension. This is a known pattern to keep a background worker permanently alive; beni… | |
| 41 | Other | low | js/app.js (line 178) | Every page opens a persistent `keep-alive` port to the (missing) background service worker and reconnects on disconnect, ensuring the service worker stays awake on essentially all browsing. Not malicious by itself, bu… | |
| 42 | Other | low | js/app.js (line 186) | Content script reads a `cssSelectors.domainSelectors` map from chrome.storage.local and applies attacker-controllable CSS selectors (queryable via querySelectorAll) on every site (<all_urls>) to hide arbitrary DOM ele… | |
| 43 | Other | low | js/app.js (line 175) | Persistent runtime port reconnect loop (every ~295s) used to keep the background service worker alive indefinitely. Common ad-blocker pattern but the MV3-discouraged keep-alive trick means the (missing) background ser… | |
| 44 | Other | low | js/app.js (line 186) | The content script reads a `cssSelectors.domainSelectors` map from chrome.storage.local and applies the per-domain selector string to `document.querySelectorAll` on every site (host_permissions <all_urls>). The select… | |
| 45 | Other | low | js/app.js (line 16) | Reassigns `document.documentElement.innerHTML` after a regex substitution of `__MSG_xxx__` tokens with `chrome.i18n.getMessage` values. The replacement source is the extension's bundled locale files, so this is not di… | |
| 46 | Other | low | js/app.js (line 186) | The content script runs on <all_urls> and reads a per-domain CSS-selector list from chrome.storage.local (cssSelectors.domainSelectors) to hide arbitrary elements on every site visited. The selector list is populated … | |
| 47 | Other | low | js/app.js (line 186) | Reads a per-domain `cssSelectors.domainSelectors` map from chrome.storage.local and applies arbitrary CSS selectors via querySelectorAll on every site (content script matches *://*/*). Because the selector list comes … | |
| 48 | Other | low | js/app.js (line 175) | Maintains a persistent runtime port to the (missing) background service worker, reconnecting every 295 seconds. This is the well-known MV3 service-worker keepalive pattern used to prevent the background from idling ou… | |
