browser-bridge

This module is a high-severity remote execution/backdoor-like agent. It accepts attacker-controlled JavaScript over a (hardcoded) WebSocket command channel, executes it inside browser tabs in the page MAIN-world context using eval/AsyncFunction and chrome.scripting.executeScript, and further escalates capability via chrome.debugger Runtime.evaluate as a fallback. It then exfiltrates execution results/errors and tab metadata back to the controlling endpoint. The design lacks visible authentication/authorization and command constraints, making it dangerous for supply-chain/backdoor scenarios.

This module is a browser automation/control server that can deliver arbitrary JavaScript supplied via HTTP/WebSocket inputs (and can forward those commands to a remote master). Although it does not directly show typical malware behaviors in this Python fragment, its unauthenticated and unsandboxed “execute arbitrary JS in a browser tab” capability constitutes a high security risk and a plausible abuse vector if any network exposure or untrusted caller access exists.

This content-script is highly indicative of malicious or unsafe behavior. It directly disables the host page’s CSP, then uses a MutationObserver plus an attacker-controlled DOM element (TID) to parse JSON commands and trigger privileged extension actions for cookies and potentially CDP/tab control. It writes the resulting sensitive data back into the host DOM, creating an exfiltration/data relay channel. Even without the extension background code, the command set and CSP bypass strongly support spyware/session-theft intent. Review/disable the package immediately in any security-sensitive environment and verify what the extension background handlers do for the received cmds (cookies/cdp/tabs/batch).

This manifest alone shows a high-risk capability profile: global injection on all sites/frames, direct cookie access, privileged debugger/CDP-bridge capability, MAIN-world page interaction, and network rule handling. No direct exfiltration or malicious payload is evidenced in the manifest fragment itself, but the combination of permissions and broad scope warrants a deep review of the referenced JS files (background.js, content.js, config.js, disable_dialogs.js) and any network/UI data handling to confirm whether the extension is privacy-invasive or otherwise abusive.

This module performs cookie harvesting for the currently active tab: it requests cookie data from a privileged extension component, displays cookie values in the extension UI, and automatically copies the full cookie name/value pairs to the system clipboard. While textContent mitigates XSS, the clipboard/UI exposure of authentication/session cookies is a high-risk behavior that is consistent with credential/cookie theft. Whether it is malicious or legitimate depends on the broader extension design and permissions (not visible here), but the security risk from this module’s behavior is substantial.