Any PII stored locally is encrypted

Plaintext PII in chrome.storage.local, chrome.storage.sync, localStorage, or IndexedDB is readable by any code with access to the extension's storage context — including a compromised extension update, a malicious dependency, or a script that gains access via a content script bridge. GDPR Art. 32 requires appropriate technical measures to protect personal data; storing an email address or user profile in cleartext fails that standard. CWE-312 (Cleartext Storage of Sensitive Information) and OWASP 2021 A02 (Cryptographic Failures) both target this exact pattern. NIST SP 800-53 SC-28 mandates data at rest protection for sensitive records.

Encrypt PII before writing it to any storage mechanism. Use TweetNaCl.js for symmetric encryption:

import nacl from 'tweetnacl';
import { encodeBase64, decodeUTF8 } from 'tweetnacl-util';

const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
const keyMaterial = await deriveKey(masterPassword); // scrypt or PBKDF2

const encrypted = nacl.secretbox(
  decodeUTF8('user@example.com'),
  nonce,
  keyMaterial
);

chrome.storage.local.set({
  encryptedEmail: encodeBase64(encrypted),
  emailNonce: encodeBase64(nonce)
});

For lighter-weight cases, crypto-js provides AES-256 with a simpler API. Never store the encryption key alongside the ciphertext in the same storage location.