This version significantly expands scam-brand detection coverage (400+ banks, fintechs, and travel/booking brands worldwide, up from a much smaller initial set), completes full translation of all phishing-detection logic into all 10 supported languages (previously several detection phrases were English-only), and adds two new detection signals: suspicious/disposable top-level domains, and near-empty page content on free hosting platforms — both common patterns in real-world phishing pages we tested against.

Note on the "Unsafe assignment to innerHTML" validation warning: all innerHTML assignments in popup.js insert only static, hardcoded translation strings, numbers, or empty placeholder elements. Any text derived from the analyzed page itself (page title, detected brand names, error messages that may echo page content) is deliberately filled in afterward via textContent rather than spliced into the innerHTML template — textContent is never interpreted as markup by the browser, so this pattern prevents a malicious page from injecting content into the extension's own popup UI. This design is intentional and documented in code comments at each site.