| 1 | Privilege Escalation | critical | bg.js (line 1) | On first install, the background script queries ALL open tabs with no URL or domain filter (chrome.tabs.query({})) and immediately injects content.js into every single one via chrome.tabs.executeScript. This aggressiv… | |
| 2 | Privilege Escalation | high | bg.js (line 1) | On installation, the background script immediately queries ALL open browser tabs and force-injects content.js into every one using chrome.tabs.executeScript. This silently executes extension code in every page the use… | |
| 3 | Privilege Escalation | high | popup.js (line 2) | The popup uses the deprecated chrome.tabs.executeScript with null as the tab ID to inject resetZoom.js into the active tab on every zoom change. Combined with the manifest's broad http://*/* and https://*/* host permi… | |
| 4 | Privilege Escalation | high | bg.js (line 1) | On installation the background script calls `chrome.tabs.query({})` with no URL filter, enumerating every open tab regardless of origin, and then calls `chrome.tabs.executeScript` to force-inject content.js into each … | |
| 5 | Remote Code Loading | high | manifest.json (line 1) | The manifest explicitly relaxes CSP to allow scripts from `https://www.google-analytics.com`, which is unusual for an extension because it permits execution of remotely hosted JavaScript in the extension context. Comb… | |
| 6 | Remote Code Loading | high | bg.js (line 27) | The background script loads `analytics.js` from a remote server and executes it inside the extension process. That is a classic remote-code-loading pattern, and the `ga("set", "checkProtocolTask", null)` change is com… | |
| 7 | Remote Code Loading | high | bg.js (line 1) | The background script dynamically injects and executes analytics.js from an external Google Analytics CDN at runtime by inserting a script element into the extension background page's DOM. This constitutes remote code… | |
| 8 | Remote Code Loading | high | bg.js (line 1) | The background script dynamically injects an external script from https://www.google-analytics.com/analytics.js at runtime by creating a DOM element and inserting it. This is remote code loading — any JavaScript serve… | |
| 9 | Tracking | high | bg.js (line 1) | The background script initializes Google Analytics with tracker ID UA-201298946-1 and deliberately sets 'checkProtocolTask' to null — a known technique to suppress GA's protocol validation so analytics beacons fire fr… | |
| 10 | Code Injection | medium | popup.js (line 1) | The full jQuery 3.4.1 library (~88KB) is bundled into popup.js, importing capabilities including $.globalEval() (evaluates arbitrary JS strings) and _evalUrl() (fetches a remote URL and evaluates its response as JavaS… | |
| 11 | Other | medium | manifest.json (line 1) | The content script is injected into every HTTP and HTTPS page at `document_start`, the earliest possible timing — before the DOM exists and before any page scripts run. Combined with broad host access (`http://*/*`, `… | |
| 12 | Tracking | medium | bg.js (line 113) | The extension notifies an external domain on install and uninstall by opening/navigating to `ladnet.co` URLs that include the unique extension ID. This can be used for install/uninstall tracking and telemetry outside … | |
| 13 | Tracking | medium | bg.js (line 1) | The background script initializes Google Analytics and dynamically injects analytics.js from google-analytics.com into the background page on every extension load. It sends a pageview hit for '/background', enabling p… | |
| 14 | Tracking | medium | bg.js (line 1) | The Google Analytics configuration explicitly nulls 'checkProtocolTask', which disables the built-in GA safeguard that prevents firing on non-http(s) pages such as chrome-extension:// URLs. This is a known technique u… | |
| 15 | Tracking | medium | bg.js (line 1) | The Google Analytics tracking ID is the literal placeholder `UA-XXXXXXXXX-1`, which should never appear in a shipped extension with 2.3 million users. A real GA property ID would be a numeric string. This indicates ei… | |
| 16 | Unauthorized Data Collection | medium | content.js (line 3) | The content script (injected at document_start on all http/https URLs) uses window.location.hostname as a dynamic storage key in chrome.storage.local, which implicitly builds a persistent map of every hostname the use… | |
| 17 | Unauthorized Data Collection | medium | popup.js (line 2) | The popup reads the active tab's full URL and extracts the hostname via new URL(l.url), then uses that hostname as a key in chrome.storage.local. This reinforces the pattern of storing per-hostname data every time the… | |
| 18 | Unauthorized Data Collection | medium | content.js (line 3) | The content script runs at document_start on every http/https page and uses window.location.hostname as the chrome.storage.local key to persist per-site zoom preferences. Over time this passively creates a persistent … | |
| 19 | Unauthorized Data Collection | medium | popup.js (line 2) | Every time the popup opens, the active tab's URL is parsed and its hostname is stored as a key in chrome.storage.local alongside the zoom value. Over the user's browsing session this accumulates a persistent map of ev… | |
| 20 | Remote Code Loading | low | popup.js (line 2) | The bundled jQuery library in popup.js includes _evalUrl, which fetches an arbitrary URL via AJAX and executes the response as JavaScript using globalEval. While this is standard jQuery infrastructure, its presence me… | |
