Medium Breaker

The extension's primary function is paywall circumvention: it hijacks the user's active tab and redirects it to Google's web cache of the current Medium URL, then dynamically installs a declarativeNetRequest rule that blocks Medium's CDN JavaScript bundle (`cdn-client.medium.com/lite/static/js/main*`). Blocking this script prevents Medium's paywall enforcement code from executing on the cached page. This is deliberate, unauthorized content access in violation of Medium's Terms of Service.

chrome.contextMenus.onClicked.addListener(async function(info, tab) {  if (info.menuItemId === "myContextMenuOption" && !(tab.url.includes("webcache.googleusercontent.com"))) {    let url = "http://webcache.googleusercontent.com/search?q=cache:" + tab.url;    chrome.tabs.update({      url: url    });    let id = Math.floor(generateUniqueId());    console.log(id)    await chrome.declarativeNetRequest.updateDynamicRules({      addRules: [{        id: id,        priority: 1,        action: {          type: "block"        },        condition: {          urlFilter: "https://cdn-client.medium.com/lite/static/js/main*",        },      }, ],    });    ids.push(id);  }});

The content script is declared with `run_at: document_start` and `all_frames: true`, which grants it execution access at the very earliest point in page lifecycle, before any DOM is ready, across every frame and iframe within the entire webcache.googleusercontent.com origin. This broader-than-necessary access grants the extension a privileged position to intercept and manipulate content in all subframes of any Google Cache page, not just the targeted Medium articles.

{  "content_scripts": [    {      "matches": [        "*://webcache.googleusercontent.com/*"      ],      "js": [        "inject.js"      ],      "css": [        "inject.css"      ],      "run_at": "document_start",      "all_frames": true    }  ]}

The content script uses a highly specific CSS selector to locate Medium's logo SVG element inside the cached page and replaces its path data with a very long, custom SVG path. This DOM manipulation is entirely unrelated to the extension's stated paywall-bypass purpose and serves no obvious functional need. Replacing visual elements like logos on injected pages is a technique used in phishing and UI spoofing attacks to make a page appear different from what users expect; here it obscures that the content is served from Google's cache.

const logoPath = document.querySelector(  '#root>div>div.l.c>div>div:nth-child(2)>div>a>svg>path');if (logoPath) {  logoPath.setAttribute(    'd',    'M 594.79 308.2 c 0 163.76 -131.85 296.52 -194.79 134.8 S 5.8 472 29 330 S 137.65 11.69 300.29 11.69 s 294.5 132.75 294.5 296.51 M 917.86 308.2 c 0 154.16 -65.93 279.12...'  );}

The extension listens to every tab update event (`chrome.tabs.onUpdated`) across all tabs in order to manage its dynamic network blocking rules. This listener fires on every navigation across all browser tabs, not just Medium tabs, giving the extension persistent visibility into the user's tab activity and URL changes. While the logic only removes rules when not on a webcache URL, the broad event listener scope is wider than necessary and constitutes ongoing unauthorized monitoring of tab navigation.

chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  if (!(tab.url.includes("webcache.googleusercontent"))) {    let rules = await chrome.declarativeNetRequest.getDynamicRules();    let rulesArr = []    for (let i of rules) {      rulesArr.push(i.id)    }    await chrome.declarativeNetRequest.updateDynamicRules({      removeRuleIds: rulesArr,    });  }});

The injected stylesheet loads a Google Font from an external origin (`fonts.googleapis.com`) every time the content script activates on a Google Cache page. This causes the browser to send a request to Google's font servers that includes the Referer header with the cached page URL, allowing Google to observe the user's browsing of cached Medium content. While Google Fonts is common on public websites, loading it from a content script injected on a third-party domain is an unnecessary external dependency that constitutes passive tracking.

@import url('https://fonts.googleapis.com/css2?family=Poppins:wght@300&display=swap');