3 ms·

Is it possible to prevent an extension from downloading a javascript payload and interpreting it? Eval isn't required.

• gorhill 7y ago
  The default `script-src` policy in extensions is 'self', no JavaScript code outside the package will be allowed to execute.