Aug 26 - Enhance security 3

extension/background.js

@@ -8,6 +8,12 @@
  *  - Lock the vault automatically after IDLE_LOCK_SECONDS of system inactivity.
  */
 
+// Public Suffix List — the badge counts matching items, and must use the same
+// same-site rule as content.js and popup.js. Counting a match on an attacker's
+// neighbouring subdomain is itself a misleading signal, even though the badge
+// alone does not disclose a credential.
+importScripts("shared/psl.js");
+
 // ── Idle lock ─────────────────────────────────────────────────────────────────
 
 // Default: never lock (session clears naturally on browser close via chrome.storage.session).
@@ -119,21 +125,24 @@ async function updateBadgeForTab(tabId, url) {
 
     let hostname;
     try {
-      hostname = new URL(url).hostname.replace(/^www\./, "");
+      hostname = new URL(url).hostname;
     } catch {
       chrome.action.setBadgeText({ text: "", tabId });
       return;
     }
 
+    // Registrable-domain comparison, matching content.js and popup.js. Falls
+    // back to exact equality if psl.js is unavailable — strict, so a load
+    // failure undercounts rather than counting an attacker's subdomain.
+    const sameSite =
+      typeof PkPsl !== "undefined" && PkPsl?.isSameSite
+        ? PkPsl.isSameSite
+        : (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
+
     const matches = vault_items.filter((item) => {
       if (item.item_type !== "password" || !item.plain?.url) return false;
       try {
-        const h = new URL(item.plain.url).hostname.replace(/^www\./, "");
-        return (
-          h === hostname ||
-          h.endsWith(`.${hostname}`) ||
-          hostname.endsWith(`.${h}`)
-        );
+        return sameSite(new URL(item.plain.url).hostname, hostname);
       } catch {
         return false;
       }