0

This is the relevant part of my manifest.json file:

"content_scripts": [
    {
      "css": ["style.css"],
      "matches": [
        "<all_urls>"
      ],
      "js": ["jquery-3.5.1.min.js", "content.js""]
    }
  ]

I noticed that now I have jquery on every page I go to and I was wondering if it's a security concern. I don't do anything fishy but I wonder whether some sites could try to exploit having jquery in scope.

My extension is supposed to work on every page so I can't blacklist certain sites.

I downloaded jquery from the official CDN once and it's now in my extension.

1
1

No, you don't have to worry about it.

Having jQuery in your extension doesn't pose any security risk. Javascript is used to run the code on the client-side of the browser if any malicious website wants to run JS on a system, they can embed it within their evil website itself; They don't have to rely on an extension to provide jQuery to do malicious things.

As @pcalkins pointed out in the comment, the browser is sandboxed and even extensions cannot execute anything outside of that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.