The bug report says: by iframing popupfilltab.html (i.e. via moz-extension, ms-browser-extension, chrome-extension, etc). It's a valid web_accessi

The bug report says: by iframing popupfilltab.html (i.e. via moz-extension, ms-browser-extension, chrome-extension, etc). It's a valid web_accessible_resource. [...] y.src="chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/popupfilltab.html"; // or y.src="moz-extension://..."; My understanding is that this should not work with the Firefox version of LastPass, since each installation of the extension is given a unique id which can't be guessed by web pages -- that is unless the unique id is made visible to web pages by the extension itself.