10 ms·
Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension://<id>/...) could be abused to learn about the user's installed extensio
by mentalgear 6mo ago
Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension://<id>/...) could be abused to learn about the user's installed extensions by checking whether it resolves or not.
- davidmurdoch 6mo agoYou would need to use use_dynamic_url: true in the manifest to create a unique one.
- acorn221 6mo agoYeah, this is the easiest way to get around it
- philipwhiuk 6mo agoOr just not allow them to load the URIs at all