3 ms·

Really? Last time I read the spec (which was a while ago), v3 disallowed unrestricted blocking, but it had no corresponding restrictions on sniffing requests a

• jimmydorry 4y ago
  The security benefit is preventing unrestricted ability for extensions to modify requests. So much malware is delivered via extension these days, and it's dead simple (and even a relatively common occurence) for a popular extension to get bought by unscrupolous actors that immediately commit changes that would be blocked by v3. GP said "step in the right direction", as this is indeed just a step and not an entire solution.
  • amluto 4y ago
    If a clever malicious extension can’t inject malware using non-blocking webRequest, I’ll eat my hat. For that matter, injecting malware using declarativeNetRequest doesn’t look particularly hard. I find it very hard to believe that the restriction on, specifically, blocking webRequest is genuinely motivated by security. If Chrome really wanted a minimal change here to improve security, they might have restricted webRequest to only permit blocking the request but not modifying it.
    • jimmydorry 4y ago
      If you prevent modifying completely, that would break large swatches of all extensions. I would imagine manifest will eventually move there, but moving straight to the end goal would have created a lot more outrage (rightly so). Again, since you seem to have ignored the main point of GP and my reply, this was the "first step" in the right direction.