This type of thing is all too common. We wrote about a worse case last year where an extension XSS'd quite literally the entire internet: https://www.tinfoilsec

This type of thing is all too common. We wrote about a worse case last year where an extension XSS'd quite literally the entire internet: https://www.tinfoilsecurity.com/blog/building-a-browser-extension-be-careful-not-t-17787 https://www.tinfoilsecurity.com/blog/building-a-browser-exte... The scariest thing here is that you have arbitrary code execution, so your options are limitless. Check out XSS Harvest: https://github.com/Miserlou/XSS-Harvest https://github.com/Miserlou/XSS-Harvest