I accidentally discovered a security flaw in your extension. When the TreeWalker object takes text from the page and adds it back to the DOM inside span innerHTML, if the text is a script, it is executed. A malicious user could steal cookies from google.com, redirect user's browser to a malicious site, among others things.
Proof:
![alert google](https://user-images.githubusercontent.com/16741330/33228439-8b289034-d19a-11e7-8717-aaf75c1c90d6.png)
Chrome with gInfinity:------------------------------------Chrome without gInfinity:
![lmjol4b](https://user-images.githubusercontent.com/16741330/33228458-0922818e-d19b-11e7-992c-b2ca714716f4.png)
As you see, the <.svg onload=alert(1)>, that appears in google index content is executed when i using your extension.
Vulnerable section of code:
chrome.runtime.sendMessage({ method: "getLocalStorage", key: "enable_links" }, function (response) {
if (response.data == "true" && document.getElementById && document.createTreeWalker && typeof NodeFilter != "undefined") {
var tw = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT, null, false);
var node;
var rem = [];
while (node = tw.nextNode()) {
if (node.nodeValue.match(reg) && node.parentNode.tagName != 'A' && node.parentNode.tagName != 'TEXTAREA' && node.parentNode.tagName != 'STYLE' && node.parentNode.tagName != 'SCRIPT' && node.parentNode.tagName != 'META' && node.parentNode.tagName != 'NOSCRIPT' && node.parentNode.tagName != 'PRE') {
var parentElem = node.parentNode;
var val = node.nodeValue.replace(reg, '<a href="$1">$1</a>');
var aNode = document.createElement("span");
aNode.innerHTML = val;
parentElem.insertBefore(aNode, node);
rem.push(node);
continue;
}
}
for (i in rem) {
rem[i].parentNode.removeChild(rem[i]);
}
}
});