It's a content-script CSS rule — no JavaScript, no background page, no permissions beyond running on mail.google.com. The rule matches stable attributes (data-pep-id, data-action-behavior) rather than Gmail's obfuscated, rotating CSS class names, so it keeps working across Gmail updates and locales.
