React Native & React Engineer

Problem

Enterprise users required seamless browser autofill and auto-login without exposing secrets to hostile DOM environments. The core technical hurdle was twofold: protecting decrypted credentials from malicious host page scripts actively inspecting input DOM nodes, and maintaining authenticated session states when Chrome's MV3 runtime aggressively terminates inactive background service workers every 30 seconds.

My role

Led frontend architecture and Chrome Extension engineering: designed the React/TypeScript popup and inline fill triggers, implemented the isolated-world content script injection bridge, and engineered the background worker session re-hydration mechanism.

Architecture

• Manifest V3 architecture enforcing strict boundary separation between ephemeral service worker, isolated-world content scripts, and React popup UI
• Session token lifecycle management utilizing volatile chrome.storage.session paired with native client cryptographic key exchanges
• Content script DOM isolation layer using Shadow DOM boundaries to inject non-tamperable autofill action chips into target input fields
• Origin-validated messaging protocol with typed RPC contracts between content scripts, runtime background, and web vaults
• Context API session bus coordinating auth state and vault synchronization across multi-tab browsing sessions

Key flows

Core Technical Challenges

• Defeating DOM Scrapers: Host scripts often hook addEventListener('input') or overwrite DOM element prototypes to steal injected credentials. We executed autofill in isolated worlds and used untampered DOM prototype setters to inject values safely without notifying third-party page trackers.
• MV3 Ephemeral Lifecycle Survival: Because Manifest V3 terminates background service workers after 30 seconds of inactivity, memory state is wiped. Rather than unsafely writing decrypted vault keys to disk, we persisted ephemeral encrypted session tokens to volatile in-memory storage (chrome.storage.session) with just-in-time worker re-hydration.
• Shadow DOM UI Boundaries: Rendered the extension's interactive autofill badges within closed Shadow DOM roots on host pages, completely isolating our styles and interactive buttons from host CSS collisions and script access.
• Cross-Surface State Synchronization: Leveraged typed runtime messaging and CustomEvent bridges to coordinate vault state between active browser tabs, the extension popup, and background workers in real time.

Security considerations

Zero plaintext credential exposure. Decrypted credentials were never held in persistent browser storage or accessible to the host page's global window object. Credential fills required explicit user gesture verification, and all inter-context communications enforced strict origin checks, CSP headers, and sanitized message boundaries.

Outcome

Shipped an enterprise-grade Chrome extension deployed to corporate users across Ziroh Labs' security suite, delivering sub-50ms autofill latency with zero session drops during MV3 background worker eviction cycles and zero credential leakage to host page scripts.