3 ms·

Note that in the context of a browser extension an "XSS vulnerability" means "a web page just got to run code with the extension's privileges".... [Disclaimer:

• vladimir-y 10y ago
  I guess extension's privileges means more privileges than a regular web page has (accessing file system for example?), if so then it's even more dramatic.
  • bzbarsky 10y ago
    Right. Extensions have more privileges than normal web pages. For the specific case here (webextensions), the extension asks for a list of permissions at install time, so which privileges it has, exactly, depends on the extension. https://developer.chrome.com/extensions/declare_permissions https://developer.chrome.com/extensions/declare_permissions has documentation on what the various permissions you can request are.