11 ms·
Chrome sandboxes fetch requests from extensions and tells the user what permissions the app is requesting, so it’s not actually that bad (barring bugs in the sa
by fiddlerwoaroof 7y ago
Chrome sandboxes fetch requests from extensions and tells the user what permissions the app is requesting, so it’s not actually that bad (barring bugs in the sandbox)
- jannes 7y agoWhat do you mean with "sandboxes fetch requests"? That's not a valid countermeasure at all... The grandparent was worried about the extension stealing his email's contents.
- iudqnolq 7y agoAbsolutely. If the extension injects JavaScript into the page to examine the email it can run a fetch in the context of that page. I think the app store should warn that a page can send data to any website if it has permission to modify any page.
- fiddlerwoaroof 7y agoIt’s been a while, but I’m pretty sure the permissions dialog explicitly calls this out.