Sadly, Amazon isn't alone in this. There is no secure CSP that Chrome implements for any of its extensions, and they don't require and sort of legitimate oversi

Sadly, Amazon isn't alone in this. There is no secure CSP that Chrome implements for any of its extensions, and they don't require and sort of legitimate oversight, so I would venture to guess that there are at least a few dozen extensions that are just as bad. We wrote about one, incidentally, a few months ago, that has hundreds of thousands of installs: https://www.tinfoilsecurity.com/blog/building-a-browser-extension-be-careful-not-t-17787 https://www.tinfoilsecurity.com/blog/building-a-browser-exte...