Dark Mode Google Docs Added Advertising After an Ownership Change

Dark Mode Google Docs added a popup advertising component in version 4.9.68. The earlier investigation placed that release shortly after an ownership change. The extension had about 500,000 installs in the July 2026 snapshot.

The artifact comparison supports a specific finding: advertising and event tracking were added, while the existing content script and background worker remained unchanged. It did not establish credential theft.

The Chrome ID is iabnclnclchijjckhdljmocghgmgnnii. Its RiskyPlugins record and the Captain Products campaign record contain the associated details. Counts and store statuses below come from the original investigation. They have not been rechecked for this revision.

What changed between the builds

The archived 4.9.67 package was 624 KB; 4.9.68 was 654 KB. Nine files changed, including four additions:

+ banner.js                    the ad framework
+ banner.png                   the banner image (770x179)
+ ui/popup/banner-config.js    per-extension campaign config
+ ui/popup/banner-init.js      mounts the banner into the popup
~ manifest.json                version string only, 4.9.67 -> 4.9.68
~ ui/popup/index.html          three new <script> tags
~ ui/popup/index.js            one new mount div
~ ui/popup/style.css           banner styling
~ _metadata/verified_contents.json   re-signature

The content script was byte-for-byte identical across these builds, as was the background worker. The added component mounted a banner in the extension popup. That limits what this diff can establish about the release.

What the banner sent

The 5 KB banner.js was readable JavaScript. Its configuration specified the tracking endpoint and destination:

var DEFAULT_CONFIG = {
	apiBaseUrl: 'https://ext-ads-mvp.captain-products.workers.dev',
	impressionPath: '/impression',
	clickPath: '/click',
	bannerId: 'darkmodegdocs_to_darkmodechrome1504_v1',
	landingUrl:
		'https://chromewebstore.google.com/detail/dark-mode-chrome/' +
		'molkadplffcfnfaaapdlhionhggonekm?utm_medium=cpm&utm_campaign=1'
};

Opening the popup sent a POST to /impression. Clicking the banner sent a POST to /click and opened the configured store URL. The utm_medium=cpm value describes the campaign’s tracking convention; it does not prove how anyone was paid.

The event-building function was:

function getEventPayload(config) {
	return { banner_id: config.bannerId, timestamp_ms: Date.now() };
}

This object contains a banner identifier and timestamp. It contains no browsing history or page content. The receiving server can still observe ordinary request metadata, and the package does not tell us what that server logs.

The banner image was bundled and the destination was set in the package. Changing those values would require different client code or configuration reaching the client; this diff alone does not demonstrate remote control of the destination.

The advertising addition deserves disclosure and review. Calling it spyware would go beyond the observed payload. Any marketplace-policy conclusion also needs the applicable policy and listing as they stood at the time.

The related extensions

The investigation started with AI Grammar Checker, which used the same Worker endpoint. The campaign record identified eight carriers, totalling about 560,000 installs, with shared infrastructure and affiliate identifier partner_id=49587.

This is the July 2026 store snapshot retained from the original report:

The different owner names do not establish different operators. Shared code and endpoints support grouping these packages for investigation, but a similar account name alone is weak attribution evidence.

Some carriers used ads-platform/scripts/tracking.js; Dark Mode Google Docs used the popup implementation above. YouTube To Text was recorded as a cross-promotion destination with about 200,000 users. No advertising payload was identified in that target in the original review. Being promoted by a carrier does not establish that it contains the carrier’s code.

Review the new owner’s release

An ownership change can preserve the extension name and install base while changing who controls future updates. The existing permissions therefore deserve another look, even if this particular release only adds a popup banner.

The extension’s broad page access is relevant to that decision. It is capability the owner could use in a later release; it is not evidence that this release used it for theft.

If the advertising or ownership change is unacceptable to you, remove the extension through chrome://extensions. Administrators should review the recorded carrier IDs against their inventory and decide which versions remain approved. Check current store and installed-version status before treating the historical table as an active block list.

This post also appears on the RiskyPlugins blog.