3 ms·
Why does that matter if the content script doesn’t have privileged access to anything itself?
by ubercow13 5y ago
Why does that matter if the content script doesn’t have privileged access to anything itself?
- brabel 5y agoBecause one can monkey-patch any JS function used by the injected script, as the OP showed, to make the injected script do whatever it wants it to.
- ubercow13 5y agoBy one, you mean the website that the script is running on right? What's a possible attack vector there? I didn't understand how an attack might work from the example in the article. If the domain of the site is checked by the browser extension outside the content process, injection of the password is initiated by the extension button not a button on the page itself so there is no API the content process has access to, and only the correct password for that domain is provided to the content script, what could the page do exactly that would be a security issue? The content process would just be responsible for receiving any password injected into the page and putting it in the righ place.