Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?

Google Chrome Content Scripts

Cross Origin Requests


1 Answer 1


Actually, they don't even have to inject JavaScript into the main page. Extensions can require permissions to make Cross-Origin requests to certain websites, see https://developer.chrome.com/extensions/xhr. They can even use the <all_urls> permission to get Cross-Origin access for all websites. This is not a security vulnerability, as you have to manually install an extension and grant the permissions on installation, making you responsible for anything that happens.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .