5

Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?

Google Chrome Content Scripts

Cross Origin Requests

Improve this question
1

1 Answer 1

Reset to default
3

Actually, they don't even have to inject JavaScript into the main page. Extensions can require permissions to make Cross-Origin requests to certain websites, see https://developer.chrome.com/extensions/xhr. They can even use the <all_urls> permission to get Cross-Origin access for all websites. This is not a security vulnerability, as you have to manually install an extension and grant the permissions on installation, making you responsible for anything that happens.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .