Google Meet Enhanced Experience

The extension injects arbitrary script text directly into the host page's DOM by creating script elements from strings. While used here to pass extension URLs to the page context, this pattern bypasses CSP and could be abused if the injected string were tampered with. The actual strings injected (lines 49-63) contain only static extension URLs and a DOM text replacement, so the risk is architectural rather than actively exploited.

function injectScript(scriptText) {  let scriptElement = document.createElement("script");  scriptElement.setAttribute("async", "");  scriptElement.appendChild(document.createTextNode(scriptText));  (document.body || document.head || document.documentElement).appendChild(    scriptElement  );}

The extension overwrites the browser's native getUserMedia API on both MediaDevices.prototype and navigator.mediaDevices. This intercepts all camera/media access on the page, routing video streams through the extension's canvas pipeline. While this is the core mechanism for applying visual effects, intercepting a sensitive browser API is a high-risk pattern — it could silently capture, modify, or redirect video streams without user awareness.

MediaDevices.prototype.getUserMedia = navigator.mediaDevices.getUserMedia = async function() {      // console.log(arguments[0]);      try {        if (arguments[0].video.deviceId && !arguments[0].jeelizUsage) {          if (!this.userType)            console.log(              "%c Google Video recording - Filter",              "background-color: #058377;"            );          try {            return await this.filterRecording(arguments[0]);          } catch (err) {            ...          }        }

The extension loads 3D model assets and face filter neural network data from an external Heroku server (visualeffectsbackend.herokuapp.com). If this server were compromised, malicious 3D model files or modified neural network weights could be served. The NNC path at line 868 also points to this same external server for the face detection model.

objLoader.load(    "https://visualeffectsbackend.herokuapp.com/api/static" + url,    (root) => {      root = edit(root);      const maskLoader = new THREE.BufferGeometryLoader();      maskLoader.load(          "https://visualeffectsbackend.herokuapp.com/api/static/faceLowPolyEyesEarsFill2.json",

A hidden developer mode is activated by setting localStorage['dev'] to 'optic', which exposes the full GoogleMeetOptics client instance on window.Client with userType=0. This enables verbose debug logging throughout the extension. While not directly malicious, exposing internal state to the page's global scope could allow other scripts to manipulate the video pipeline.

if (localStorage["dev"] !== "optic") var Client = new GoogleMeetOptics();if (localStorage["dev"] === "optic") window.Client = new GoogleMeetOptics(0);

The extension runs a persistent setInterval that modifies Google Meet's UI text, changing 'Camera is starting' to 'Plugins being installed'. This DOM manipulation on a 500ms interval could mislead users about what is happening with their camera, and the XPath-based DOM traversal pattern could be adapted to target other UI elements.

injectScript(  `   setInterval(() => {let a=document.evaluate("//div[text()='Camera is starting']",document,null,XPathResult.FIRST_ORDERED_NODE_TYPE,null).singleNodeValue;if(a){a.innerText="Plugins being installed"}}, 500)`);