I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The reason why I am asking this question is because I am considering a threat model where there can be a malicious script running in the computer and trying to communicate with the app.
I am aware that browsers always put the ID of the extension in the "Origin" header of the websocket's handshake. However, that can be easily forged by a malicious script running outside of the browsers.