3 ms·
Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile. Just don't let them create script elements, or add any URLs
by nitrogen 6y ago
Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.
Just don't let them create script elements, or add any URLs that don't come from within the extension bundle itself. Browsers already have to do a ton of bookkeeping to track the origins of requests anyway. Doesn't seem hard, you just have to be thorough.
- londons_explore 6y agoThere would be ways to trick the original page into adding stuff for you. For example, you could patch some of the original script of the page and wait for it to be run.
- Dylan16807 6y agoRestricting the extension to pre-baked URLs means it takes several page loads to exfiltrate something, but doesn't stop it.