Is Hover Zoom+ safe?

// Injected as a <script> tag into every google.* page.// Replaces XMLHttpRequest.prototype.open — affects ALL XHR on the page,// not just extension-initiated ones.if (typeof oldXHROpen !== 'function') {  // guard: hook only once per tab    oldXHROpen = window.XMLHttpRequest.prototype.open;  // save original    window.XMLHttpRequest.prototype.open = function(method, url, async, user, password) {        // Register a listener before the request starts:        this.addEventListener('load', function() {            try {                // No URL check — captures ALL XHR responses:                let existing = sessionStorage.getItem('hoverZoomXHROpenData');                if (existing == null) {                    sessionStorage.setItem('hoverZoomXHROpenData', this.responseText);                } else {                    // Concatenate indefinitely; only resets if storage is full:                    sessionStorage.setItem('hoverZoomXHROpenData', existing + this.responseText);                }            } catch {}        });        // Proceed with the original open() call:        return oldXHROpen.apply(this, arguments);    };}

// Both window.fetch and XMLHttpRequest.prototype.open are replaced// so the extension can intercept responses before Vinted's own JS processes them.// Filter: only catalog and homepage API paths are intercepted:function shouldIntercept(url) {    return url.includes('/api/v2/catalog/items') || url.includes('/api/v2/homepage/');}// Storage helper: overwrites (does not append) sessionStorage on each intercepted response:function store(text) {    sessionStorage.setItem('hzVintedApiData', text);  // latest response only    document.dispatchEvent(new CustomEvent('hzVintedApiData'));  // notify content script}// Fetch hook — response is cloned so Vinted's own .then() still resolves:window.fetch = function(...args) {    const url = (typeof args[0] === 'string') ? args[0] : (args[0] && args[0].url) || '';    const promise = originalFetch.apply(this, args);    if (shouldIntercept(url)) {        promise.then(resp => {            resp.clone().text().then(text => {                if (text.includes('"photos"') || text.includes('"blocks"')) {                    store(text);  // captured: Vinted listing API payload                }            });        });    }    return promise;  // original promise returned unmodified};

// STEP 1 — vinted.js detects a homepage feed item on hover:var useWardrobeApi = itemHref.includes('homepage_session_id=') || location.pathname === '/';// homepage_session_id= only appears on items from the Vinted homepage feed.// STEP 2 — buildWardrobeApiUrl() constructs the paginated endpoint:function buildWardrobeApiUrl(userId, page) {    // wardrobePageSize = 20 (hard-coded)    return '/api/v2/wardrobe/' + userId + '/items?page=' + page + '&per_page=20&order=newest_first';}// STEP 3 — crawlWardrobe() paginates until complete:function crawlWardrobe(userId) {    // Sends hzVintedWardrobeRequest CustomEvent to the page-world script.    // Page-world script issues the actual fetch with session cookies:    _origFetch.call(window, wardrobeUrl, {        credentials: 'include',  // <-- attaches the user's Vinted session cookies        cache: 'no-store',        headers: { Accept: 'application/json, text/plain, */*,image/webp' }    });    // Response is stored in plug._wardrobeCatalogs[userId] for the zoom gallery.    // Crawl continues to the next page until state.complete === true.}