There's a difference between user content, which could include injection attacks. And what might be called operator content (operator of the browser in this cas

There's a difference between user content, which could include injection attacks. And what might be called operator content (operator of the browser in this case, which could also be considered a user), sure I want to be protected against hostile injection, but I should be able to inject code into my own browser without any issue.