Clear Pip View

The background service worker exfiltrates a persistent per-user UUID (client_id/user_id) and session_id to Google Analytics 4 Measurement Protocol with a hardcoded api_secret (ZPzaor2gRqiZQ_ZmZfRyww) and measurement_id (G-2F5NKH17B2). The api_secret is embedded in the extension code, and the user has no opt-out — this is unauthorized analytics tracking from a Chrome extension whose stated function is Picture-in-Picture.

async function pH(pT, Bj, hU, uo, na) {  const Sf = undefined,    pH = {      user_id: Bj,      client_id: Bj,      events: [{        name: pT,        params: {          session_id: hU        }      }]    },    sg =    `https://www.google-analytics.com/mp/collect?${new URLSearchParams({api_secret:uo,measurement_id:na}).toString()}`;  await fetch(sg, {    method: "POST",    headers: {      "Content-Type": "application/json"    },    body: JSON.stringify(pH)  })}

On install/update and every service-worker wakeup the extension iterates ALL currently open tabs and injects content.js into every frame using `world: "MAIN"` — i.e., the page's own JavaScript context with full access to page globals/variables, not the isolated content-script world. This is a privilege-escalation pattern that lets injected code read/modify any site's runtime state and bypass page-context isolation.

async function Sf() {  const pT = await chrome.storage.local.get("enabled");  (null == pT ? void 0 : pT.enabled) || await chrome.storage.local.set({    enabled: !0  });  const Bj = await chrome.tabs.query({});  for (const pT of Bj)    if (pT.id) try {      await chrome.scripting.executeScript({        files: ["js/content.js"],        injectImmediately: !0,        target: {          tabId: pT.id,          allFrames: !0        },        world: "MAIN"      })    } catch (pT) {}}

Generates and persists a stable per-installation UUID (`cid`) in chrome.storage.local that survives browser restarts, paired with a session UUID (`sid`). Combined with the all_frames document_start MAIN-world content script and <all_urls> host permissions, this creates a stable cross-site tracking identifier transmitted to the developer's GA4 property.

async function na() {  const pT = await new Promise((pT => {    chrome.storage.local.get(["cid"], (Bj => {      pT(Bj)    }))  }));  let {    cid: Bj  } = pT;  return Bj || (Bj = (0, uo.v4)(), chrome.storage.local.set({    cid: Bj  })), Bj}async function Sf() {  const pT = await new Promise((pT => {    chrome.storage.session.get(["sid"], (Bj => {      pT(Bj)    }))  }));  let {    sid: Bj  } = pT;  return Bj || (Bj = (0, uo.v4)(), chrome.storage.session.set({    sid: Bj  })), Bj}

Creates a recurring `ga4` alarm (daily) and unconditionally fires telemetry events (`first_open`, `tutorial_begin`) on every service worker startup. The alarms permission is being used to keep the extension's analytics pings active rather than for any user-facing feature.

async function sg(pT, Bj) {  chrome.runtime.onInstalled.addListener((async hU => {    if ("install" === hU.reason) {      const hU = await na(),        uo = await Sf();      await pH("first_open", hU, uo, Bj, pT)    }  }));  const hU = await na(),    uo = await Sf();  await pH("tutorial_begin", hU, uo, Bj, pT), chrome.alarms && chrome.alarms.create("ga4", {    periodInMinutes: 60 * 24  })}

Content script is registered with extremely broad scope: every http/https URL, all frames (including cross-origin iframes), about:blank documents, and earliest possible execution (document_start). Combined with `<all_urls>` host_permissions and the MAIN-world programmatic injection in background.js, the extension has the technical capability to observe and manipulate any site the user visits — far broader than required for a per-site Picture-in-Picture button.

{  "content_scripts": [    {      "matches": [        "http://*/*",        "https://*/*"      ],      "js": [        "js/content.js"      ],      "all_frames": true,      "match_about_blank": true,      "run_at": "document_start"    }  ]}

Creates a <script> element, sets textContent, and appends it to document.head to execute code in the page's main world. The injected payload here is benign (`document.exitPictureInPicture()`), but the pattern itself is a code-injection sink — under MV3 this technique is commonly used to evade CSP/isolated-world restrictions. Worth flagging because the content script already runs at document_start in all_frames including about:blank.

case na.a.CHROME:  if (Bj) {    const pT = document.createElement("script");    pT.textContent = "document.exitPictureInPicture()", document.head.appendChild(pT), pT.remove()  } else pT.removeAttribute("disablepictureinpicture"), pT.requestPictureInPicture();break;