WAIT_UNTIL_MAIN_LOADED has no sender, and its ping would be answered by any frame; sources with full request headers are broadcast to every player-page tab in every window and container #145

Severity: low

1. Dead code (chrome/background/background.mjs, TabTracker's loadedCallbacks): grep -rn WAIT_UNTIL_MAIN_LOADED chrome finds only the enum, the handler and a TabTracker comment. The handler also sends PING_TAB without a frameId, so any iframe's content script answering PONG_TAB counts as "main loaded". Remove the branch and the loadedCallbacks plumbing, or give the ping {frameId: 0} if it is kept.

2. Cross-context exposure (sendSourcesToMainFramePlayers): it queries all tabs and sends frame.getSources() (each entry carrying the page's requestHeaders array, Cookie and Authorization included) to every tab whose URL is the player page, regardless of window, cookie store or private-browsing status, once per detected source. A stream with a signed URL and the user's cookies detected in container A appears in the sources browser of a player tab open in container B or a private window. The recipient is an extension page, not a web page, so this is upstream design and a judgement call; restricting to player tabs with the same cookieStoreId/incognito as the source tab (both in tabs.query results), and stripping Cookie/Authorization when broadcasting to another tab, would close it.

Confidence: high.

From a line-by-line code review of the tree at 41363fd (2026-10-02). Each claim above was checked against the source before filing; the reproduction steps and line references are as of that commit.

Generated by Claude Code