Google Optimize A/B variant switcher

The `renderForm` method injects values from `this.id`, `this.alias`, `this.expiry`, and `this.flowId` (all derived from cookie data) directly into `targetElement.innerHTML` using template literals without any sanitization or escaping. If a malicious `_gaexp` cookie value contains HTML or script tags, this could lead to DOM-based XSS within the extension popup context. Extension popup pages run with elevated privileges, making XSS here potentially more impactful than on a regular web page.

renderForm(targetElement) {  targetElement.innerHTML += `            <tr data-id="${this.id}" id="${this.rowId}">                <td><input type="text" class="form-control input-alias" value="${this.alias}" placeholder="Experiment alias"></td>                <td><input type="text" class="form-control input-id" value="${this.id}"></td>                <td><input type="number" class="form-control input-expiry" value="${this.expiry}" min="0" max="99999"></td>                <td><input type="number" class="form-control input-flow-id" value="${this.flowId}" min="0" max="1000"></td>                <td><button class="btn btn-default"><i class="icon icon-trash"></i></button></td>            </tr>        `;}

The extension reads the `_gaexp` cookie from the currently active tab using `chrome.cookies.get`. While the stated purpose is to display Google Optimize experiment data, accessing cookies via the Chrome cookies API with broad tab URL access represents a credential/cookie access pattern that could be misused. The deprecated `chrome.tabs.getSelected` API is used here, which also unnecessarily accesses tab metadata.

chrome.tabs.getSelected(null, function(tab) {  chrome.cookies.get({    url: tab.url,    name: '_gaexp'  }, (optimizeCookie) => {    if (!optimizeCookie) {      console.log('No Google Optimize cookie found.');      return;    }    new GoogleOptimize(tab.url, optimizeCookie, tab);  });});

The background script silently monitors every tab activation and update event, calling `chrome.cookies.get` for each tab to check for the `_gaexp` cookie. While the intent is to show/hide the page action, this means the extension is continuously reading cookie data from every tab the user visits or updates, not just when the user explicitly invokes the extension. This constitutes passive, ongoing monitoring of browsing activity and cookie access across all tabs.

function doCheck(tabId) {  chrome.tabs.get(tabId, (tab) => {    chrome.cookies.get({      url: tab.url,      name: '_gaexp'    }, (optimizeCookie) => {      if (optimizeCookie) {        chrome.pageAction.show(tabId);      } else {        chrome.pageAction.hide(tabId);      }    });  });}chrome.tabs.onActivated.addListener((activeInfo) => doCheck(activeInfo.tabId));chrome.tabs.onUpdated.addListener((tabId) => doCheck(tabId));