When an extension has the ability to inject arbitrary JS into a page, it's not easy to determine whether any given request is being triggered by the host page o

When an extension has the ability to inject arbitrary JS into a page, it's not easy to determine whether any given request is being triggered by the host page or by the extension.