> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees vi

> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website. No, the "so basically" is the employee added another URL & a string to a map of URLs & strings in an existing extension. The extension already existed. It already showed notifications on various URLs. She didn't create that part.