Block Site - Site Blocker & Focus ModeSecurity Analysis

Manages other extensions, could disable security tools or install malware.

Uses eval() to execute dynamic code, a common technique for obfuscation and code injection.

Dynamically sets a script's src attribute to load external code at runtime.

Uses eval() to execute dynamic code — a common vector for code injection.

Command injection via template function

Prototype pollution via defaultsDeep

Line exceeds 5000 characters (entropy: 5.1789601088738895)

Prototype pollution via merge/mergeWith/defaultsDeep

Arbitrary code execution via template function

Content script matches <all_urls>, executing on every website the user visits.

Extension uses tab tracking APIs (onUpdated/query) and communicates with external servers — potential browsing surveillance.

Sets innerHTML directly, which can lead to XSS if used with untrusted data.

Creates a Web Worker, which runs code in a separate thread — can be used for background computation or crypto mining.

object-src is not set to 'none'. Plugins like Flash can be embedded, which may allow code execution.

javascript/RateUsModalProvider.js

javascript/content.js

javascript/getRoutePath.js

javascript/getRoutePath.js

javascript/popup.js