So clearly injecting third-party code into an SSL-served website considered malicious attack? If it can be done for Chrome download webpage, then this attack ve

So clearly injecting third-party code into an SSL-served website considered malicious attack? If it can be done for Chrome download webpage, then this attack vector is possibly open inside edge for other web pages? I'm afraid bad actor can find it quickly and use the "feature" to inject his own login form into banking websites unchecked, I wonder if it's too different from injecting an ad.