Can chrome extensions make cross-origin requests by injecting a javascript into the main page? If so, isn't it a security vulnerability?

Google Chrome Content Scripts

Cross Origin Requests


Actually, they don't even have to inject JavaScript into the main page. Extensions can require permissions to make Cross-Origin requests to certain websites, see https://developer.chrome.com/extensions/xhr. They can even use the <all_urls> permission to get Cross-Origin access for all websites. This is not a security vulnerability, as you have to manually install an extension and grant the permissions on installation, making you responsible for anything that happens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.