I don't see how the OpenSSH code is expected to automagically insure that keystrokes sent from Google Chrome came from intentional user generated actions. Any

I don't see how the OpenSSH code is expected to automagically insure that keystrokes sent from Google Chrome came from intentional user generated actions. Any XSS type vulnerabilities in this are likely the result of issues with the extension itself rather than OpenSSH, IMO.