3 ms·

I really really really want a better security model for chrome extensions. As an example, I'd be happy to install this extension if it didn't "have access to"

I really really really want a better security model for chrome extensions. As an example, I'd be happy to install this extension if it didn't "have access to" my gmail content, but was somehow able to add DOM matching and mutating callbacks that were run under Gmail. The matching part would be under my control and couldn't be updated by the extension. For example I'd be happy to let this extension mutate any img tag. I'm sure you can find a million holes in this idea, but it would be better than what we have today.

alooPotato 12y ago
Maybe if the permission was something like "Let this extension read and mutate stuff on the page but don't let it make any ajax requests". Would that be sufficient?
- joshuacc 12y ago
  Not the person you were responding to, but this could be easily worked around by sticking `img` tags into the page with urls that are crafted to share information.
- deleted 12y ago
  [deleted]