I've just discovered this:
- You can create IFRAME pointing to "chrome-extension://" protocol
- You can access IFRAME content with jQuery
Does this mean, I'm able to use badly written Chrome Extensions to exploit user workspace?
- accessing extension files directly (sqlite db with passwords,...)
chrome.extension.sendRequestcall to interact with foreign extensions
to for example forcing stubleupon extension to like my page, without user confirming/creating the action?
Is this security issue or not?