Content Script

notice.html innerHTML Assignment in Browser Extension: CWE-79

A browser extension's content script fetched notice.html and assigned it directly to innerHTML, creating a DOM-based XSS vector if the extension package were compromised. The fix removes notice.html generation from the build process entirely and restructures the shadow DOM injection to use safe textContent assignment for styles only.