Page data is sanitized

CWE-79 (XSS) in a content script context is dangerous not just for the extension user but for the host page: a content script that reads text from the DOM and inserts it back via innerHTML without sanitization can be triggered by the host page itself injecting a payload. CWE-116 (Improper Encoding or Escaping) names the adjacent failure. OWASP A03 (Injection) applies. Content scripts occupy a trusted position relative to the host page — they can read storage, message the background script, and interact with chrome.* APIs — so an XSS here has a blast radius beyond what a typical page-level XSS would achieve.

Replace innerHTML assignments with textContent for text data. If rendering HTML from page data is unavoidable, wrap it with DOMPurify before insertion.

// src/content.js — safe DOM manipulation
element.textContent = scrapedText; // Safe: no HTML parsing

// If HTML is required:
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(scrapedHtml);

Never pass a variable derived from document.querySelector, location.href, or window.name directly into innerHTML or outerHTML.