3 ms·
> It means they can view/modify the DOM of those sites. Not really into this topic (extensions), but could this capability be used by an extension to create fa
by martin_a 5y ago
> It means they can view/modify the DOM of those sites.
Not really into this topic (extensions), but could this capability be used by an extension to create fake (invisible) login forms, grab your login data through auto-complete and send it home?
- horsawlarway 5y agoI mean - yes, although there's no real reason to even bother with the fake login form. They could just monitor the real login form the next time you login. That said - at least for google, login is on accounts.google.com - so they aren't asking for that here. Additionally, these extensions do go through review by google - something as blatant as a content_script that's phoning home with login details would ideally be caught (I develop extensions for work, but haven't tried submitting something malicious for review - so I can't really comment on whether they DO actually catch it)