AHA Music - Song Finder for BrowserSecurity Analysis

The 'unsafe-eval' source allows eval(), new Function(), and similar dynamic code execution — a major code injection risk.

Creates functions from strings, similar to eval(), often used to hide malicious code.

Dynamically creates script elements, potentially loading external malicious code.

Dynamically sets a script's src attribute to load external code at runtime.

Creates a function from a string (new Function()), similar to eval().

Dynamically creates iframe elements, which can be used to load external content or hide malicious UI.

Line exceeds 5000 characters (entropy: 5.346178288194431)

Content script matches <all_urls>, executing on every website the user visits.

Sets innerHTML directly, which can lead to XSS if used with untrusted data.

Encodes data to base64, may be used for data exfiltration.

object-src is not set to 'none'. Plugins like Flash can be embedded, which may allow code execution.

popup.js

popup.js

sandbox.js