> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website.

No, the "so basically" is the employee added another URL & a string to a map of URLs & strings in an existing extension.

The extension already existed. It already showed notifications on various URLs. She didn't create that part.