Readl Reader mode

The background page implements Google Analytics tracking (UA-211039558-1) with `ga('set','checkProtocolTask',null)` — a well-known technique to disable GA's built-in protocol validation check, which normally prevents GA from firing on non-HTTP protocols like `chrome-extension://`. This intentional bypass allows covert analytics collection within the extension context. A pageview hit is fired on every browser session start, reporting extension usage back to a third-party analytics endpoint without any user disclosure.

window.ga = window.ga || function() {    (ga.q = ga.q || []).push(arguments)  }, ga.l = +new Date, ga("create", "UA-211039558-1", "auto"), ga("set", "checkProtocolTask", null), ga("send", {    hitType: "pageview",    page: "/background"  }),  function() {    const e = document.createElement("script");    e.type = "text/javascript", e.async = !0, e.src = "https://www.google-analytics.com/analytics.js";    const t = document.getElementsByTagName("script")[0];    t.parentNode.insertBefore(e, t)  }();

Full page URLs are stored as keys in `chrome.storage.sync` (values 0/1 to toggle reader mode). Because `chrome.storage.sync` is backed by Google Sync servers, every URL the user opens in reader mode is transmitted to and persisted on Google's infrastructure. Combined with `content.js` running on every page load to query these same sync keys, the extension effectively builds and remotely stores a browsable URL history without explicit user disclosure that this data leaves the device.

"open-reader" === e.cmd && e.article ? (chrome.storage.sync.set({    [t.tab.url]: 1  }), cache[t.tab.id] = e.article, cache[t.tab.id].url = o, chrome.tabs.update(r, {    url: chrome.runtime.getURL("reader/index.html?id=" + r)  }))...  // and later when closing:  var n = String(e.favIconUrl).replace("chrome://favicon/", "");chrome.storage.sync.set({  [n]: 0})

This content script runs on every page the user visits (matches `<all_urls>`, all frames) and calls `chrome.storage.sync.get` with the current page's full URL as the lookup key on every single page load. While the stated purpose is to auto-enable reader view, this pattern means a network round-trip to Google Sync occurs for every URL the user navigates to, allowing Google to observe browsing patterns through sync access logs. The all-frames injection also means iframes within pages trigger this lookup.

chrome.storage.sync.get([window.location.href], (function(e) {  1 == e[window.location.href] && chrome.runtime.sendMessage({    type: "enable"  })}));

The reader view page loads CSS and font resources directly from three external CDN domains (cdnjs.cloudflare.com, stackpath.bootstrapcdn.com, fonts.googleapis.com). Each of these requests reveals the user's IP address and that they are using this extension to external parties. The manifest's `content_security_policy` only restricts `script-src` and `object-src`, leaving stylesheet sources unrestricted — meaning these external style loads bypass CSP scrutiny. Loading remote stylesheets also opens a risk of supply-chain style injection if any CDN is compromised.

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"><link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css"  integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous"><link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans&display=swap" rel="stylesheet">