Aug 26 - Enhance security 3

extension/background.firefox.js

@@ -113,14 +113,21 @@ async function updateBadgeForTab(tabId, url) {
       return;
     }
     let hostname;
-    try { hostname = new URL(url).hostname.replace(/^www\./, ''); } catch {
+    try { hostname = new URL(url).hostname; } catch {
       chrome.browserAction.setBadgeText({ text: '', tabId }); return;
     }
+    // Registrable-domain comparison via the vendored PSL (loaded ahead of this
+    // file by manifest.firefox.json background.scripts), matching content.js
+    // and popup.js. Falls back to exact equality so a load failure undercounts
+    // rather than counting an attacker's neighbouring subdomain.
+    const sameSite =
+      typeof PkPsl !== 'undefined' && PkPsl?.isSameSite
+        ? PkPsl.isSameSite
+        : (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
     const matches = vault_items.filter((item) => {
       if (item.item_type !== 'password' || !item.plain?.url) return false;
       try {
-        const h = new URL(item.plain.url).hostname.replace(/^www\./, '');
-        return h === hostname || h.endsWith(`.${hostname}`) || hostname.endsWith(`.${h}`);
+        return sameSite(new URL(item.plain.url).hostname, hostname);
       } catch { return false; }
     });
     if (matches.length > 0) {