4 ms·
Except the extension could just inject a script into the webpage and exfiltrate data that way.
by vengefulduck 7y ago
Except the extension could just inject a script into the webpage and exfiltrate data that way.
- rndgermandude 7y agoThat requires some different permissions to the webRequest permission in question. But yeah, a bad actor would probably just switch away from webRequest to <all_urls> + webNavigation permissions and siphon off data with content scripts. So google's argument that is is a privacy issue and thus they just HAVE TO cripple their webRequest APIs doesn't get any better.
- shawnz 7y agoThat is still possible with Chrome's new declarative model too, so the parent's idea is strictly an improvement.