News for hackers. Stuff that matters.
Re:LastPass autofill exploit by AgentME on Friday July 29, 2016 @10:36PM (#12191381)
Chrome extensions' content scripts are under stronger isolation from the page than greasemonkey scripts are (or were? -- I'm not sure if greasemonkey has changed since). Chrome extensions run in a separate "isolated world" from the page. They never share javascript objects directly. (They do share the DOM, but the isolated world gets its own separate Javascript wrappers around the DOM.) It's not possible to leak a function from the extension to the page, etc.

There are no comments on this comment yet.