EditThisCookie

This file is loaded as the last entry in the background page script array (manifest.json lines 23-31), meaning it runs persistently in a privileged extension context with access to the cookies API. It dynamically injects a remote script from ssl.google-analytics.com at runtime and fires a 'Heartbeat' analytics event every 4 minutes regardless of user activity. Setting _setSessionCookieTimeout to 0 disables session cookie expiration, enabling indefinite tracking of the user's browser activity. While Google Analytics is a known service, embedding it in a persistent background page that has full cookie access and runs 24/7 is architecturally unusual and creates a persistent outbound telemetry channel from a privileged context.

var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-33054271-5']);_gaq.push(['_setSessionCookieTimeout', 0]);_gaq.push(['_trackPageview']);(function() {  var ga = document.createElement('script');  ga.type = 'text/javascript';  ga.async = true;  ga.src = 'https://ssl.google-analytics.com/ga.js';  var s = document.getElementsByTagName('script')[0];  s.parentNode.insertBefore(ga, s);})();setInterval(function() {  _gaq.push(['_trackEvent', 'Heartbeat', 'Heartbeat']);}, 4 * 60 * 1000);

The background page dynamically loads and executes a remote JavaScript file from ssl.google-analytics.com at runtime. The background page runs with elevated Chrome extension privileges including access to chrome.cookies, chrome.tabs, and chrome.webRequest. If the Google Analytics CDN endpoint were ever tampered with or the CDN used to serve a malicious payload, this remote code would execute in a context with full access to user cookies across all domains. This is a classic supply-chain risk vector embedded in a high-privilege context.

(function() {  var ga = document.createElement('script');  ga.type = 'text/javascript';  ga.async = true;  ga.src = 'https://ssl.google-analytics.com/ga.js';  var s = document.getElementsByTagName('script')[0];  s.parentNode.insertBefore(ga, s);})();

The extension installs a blocking webRequest listener on all URLs (<all_urls>) with extraHeaders access, meaning it intercepts every single HTTP and HTTPS response the browser receives across all websites. The listener parses raw Set-Cookie response headers and can silently suppress them before they reach the browser. Note that loop variables headersToForward, headersChanged, cH, and fields are undeclared globals (no var/let/const), creating implicit globals that could be overwritten by other scripts in the same background page context. While the stated purpose is cookie filtering, this interception point covers the entirety of the user's web traffic.

chrome.webRequest.onHeadersReceived.addListener(  function(details) {    headersToForward = [];    if (details.responseHeaders !== undefined) {      headersChanged = false;      for (var i = 0; i < details.responseHeaders.length; i++) {        cH = details.responseHeaders[i];        if (cH.name.toUpperCase() != "SET-COOKIE") {          headersToForward.push(cH);          continue;        }        // ... parses cookie fields ...        if (cookieName !== undefined && cookieDomain !== undefined && cookieValue !== undefined) {          var forwardHeader = true;          for (var x = 0; x < data.filters.length; x++) {            if (filterMatchesCookie(data.filters[x], cookieName, cookieDomain, cookieValue)) {              forwardHeader = false;              break;            }          }        }      }    }    if (headersChanged) {      return {        responseHeaders: headersToForward      };    }  }, {    urls: ["<all_urls>"]  },  ["blocking", "responseHeaders", "extraHeaders"]);

The background page registers a persistent listener on chrome.cookies.onChanged that fires for every cookie set or removed across all websites the user visits. On each event, it extracts the cookie name, domain, and full value from every cookie change system-wide. While these values are only used locally for rule matching, this means the extension has real-time visibility into every authentication token, session cookie, and tracking cookie set by any website. Combined with the GA background heartbeat also running in the same background page, all this activity occurs in a single persistent privileged context.

chrome.cookies.onChanged.addListener(function(changeInfo) {  var removed = changeInfo.removed;  var cookie = changeInfo.cookie;  var cause = changeInfo.cause;  var name = cookie.name;  var domain = cookie.domain;  var value = cookie.value;  if (cause === "expired" || cause === "evicted")    return;  for (var i = 0; i < data.readOnly.length; i++) {    // ... read-only enforcement ...  }  // Check if a blocked cookie was added  if (!removed) {    for (var i = 0; i < data.filters.length; i++) {      var currentFilter = data.filters[i];      if (filterMatchesCookie(currentFilter, name, domain, value)) {        // removes matching cookies      }    }  }});