Enhanced browser-side security + injected message parsing