5

Suppose an extension has a scary list of permissions like that below ("Site access: On all sites"):

enter image description here

Does this also give the extension permission to send my data to the author's servers via XHR?

I've read the documentation here but lack some background knowledge, so I am not sure in my interpretation:

Cross-Origin XMLHttpRequest

After reading this, it seemed like the extension isn't allowed to send my data somewhere unless it has lines like the below in the manifest - is this correct?

"permissions": [
    "https://www.google.com/"
  ]
1
+50

After reading this, it seemed like the extension isn't allowed to send my data somewhere unless it has lines like the below in the manifest - is this correct?

This is incorrect.

XHR (and fetch) requires the permissions key to be set correctly to avoid cross-origin restrictions, but there are various ways to send data to a remote server, f.e. an auto-submitting form in a iframe, or loading a remote image with some parameters in the URL.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.