QuickLinker

User-controlled `version.name` and `version.baseUrl` from chrome.storage.sync are concatenated into innerHTML without escaping (unlike renderSites which escapes). If an attacker can influence storage.sync via imported settings JSON, this yields DOM-XSS in the popup's elevated context. Exploitability is limited (attacker must get user to import crafted settings), but it is a real injection sink.

versionDiv.innerHTML = `        <span class="drag-handle">☰</span>        <span class="version-name-display">${version.name}</span>        <span class="version-url-display">${version.baseUrl}</span>        <button class="edit-version-btn" title="編輯版本"><i class="fi fi-rr-edit"></i></button>        <button class="delete-version-btn" title="刪除版本"><i class="fi fi-rs-trash"></i></button>    `;

Content script injects Google favicon requests containing the hostnames of the user's configured target sites (which include adult/JAV sites) on every page where the floating button appears. This leaks browsing/configuration metadata to a third party (Google) without user consent. Low-risk tracking side-effect typical of many extensions, not clearly malicious but worth noting.

let faviconUrl = '';try {  const hostname = new URL(result.finalUrl || result.url)    .hostname;  faviconUrl = `https://www.google.com/s2/favicons?domain=${hostname}`;} catch (e) {  console.error('Error getting favicon hostname:', e);}if (faviconUrl) {  subButton.style.backgroundImage = `url(${faviconUrl})`;}

Because the manifest matches `*://*/*`, the content script observes DOM mutations and polls the URL on every site the user visits. While the extracted data is only used locally to build the floating button, this broad scope gives the extension visibility into all pages and expands attack surface. No exfiltration channel observed; data stays local.

const observer = new MutationObserver(() => {  if (_codeFound) return;  clearTimeout(_observerDebounceTimer);  _observerDebounceTimer = setTimeout(async () => {    const extractResult = await getCode();    ...  }, 300);});observer.observe(document.body, {  childList: true,  subtree: true});setInterval(() => {  if (location.href !== _lastCheckedUrl) {    ...  }}, 1000);