Nightfall - dark theme

The popup HTML loads external resources from third-party CDNs (stackpath.bootstrapcdn.com and fonts.googleapis.com) every time the user opens the extension popup. This causes the user's IP address, browser fingerprint, and popup-open timing to be leaked to StackPath and Google servers. For an extension with access to all URLs and tabs, this constitutes unauthorized telemetry sent to third-party tracking infrastructure on each popup interaction.

<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css"  integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous"><link href="https://fonts.googleapis.com/css2?family=Bellota+Text:ital,wght@0,400;0,700;1,400&display=swap"  rel="stylesheet"><link href="https://fonts.googleapis.com/css2?family=Raleway:wght@400;700&display=swap" rel="stylesheet">

The full moment.js date library (4,601 lines) is injected as a content script into every page at document_start, yet inject.js contains no references to moment or any date/time functionality that would require it. A legitimate dark-theme extension has no use for a date-parsing library executing on all pages before DOM load. Bundling an unnecessary well-known library is a common technique to pad extension code to appear legitimate or to provide a preloaded global (moment) that a future injected payload could call without detection.

{  "content_scripts": [    {      "js": [        "moment.js"      ],      "matches": [        "<all_urls>"      ],      "run_at": "document_start"    },    {      "all_frames": true,      "exclude_globs": [        "*/chrome/newtab*"      ],      "js": [        "inject.js"      ],      "match_about_blank": true,      "matches": [        "<all_urls>"      ],      "run_at": "document_start"    }  ]}

inject.js runs at document_start with all_frames: true and match_about_blank: true, meaning it executes inside every iframe—including sandboxed about:blank frames—on every page. Combined with the <all_urls> host permission, this gives the content script execution context inside embedded payment widgets, OAuth dialogs, and banking iframes. A dark-theme extension only needs to apply CSS; injecting script into all frames including blank ones is broader access than warranted.

{  "all_frames": true,  "exclude_globs": [    "*/chrome/newtab*"  ],  "js": [    "inject.js"  ],  "match_about_blank": true,  "matches": [    "<all_urls>"  ],  "run_at": "document_start"}