Re:Firefox is on a slippery slope
by acqq on Monday December 18, 2017 @09:47AM
(#15951930)
Indeed, that was not a normal extension:
"The addon is actually deployed as an embedded WebExtension, which is subtly different. It has a 40-line legacy XUL/XPCOM bootstrapper controlling whether the WebExtension part of it runs. The legacy code actually could upload your hard drive and isn't bound by any of the WebExtension restrictions. We know it doesn't do anything harmful, but it could have done so.
The WebExtension itself also has <all_urls> and webRequest permissions, granting it the ability to sniff the content and headers of every page."
"The addon is actually deployed as an embedded WebExtension, which is subtly different. It has a 40-line legacy XUL/XPCOM bootstrapper controlling whether the WebExtension part of it runs. The legacy code actually could upload your hard drive and isn't bound by any of the WebExtension restrictions. We know it doesn't do anything harmful, but it could have done so.
The WebExtension itself also has <all_urls> and webRequest permissions, granting it the ability to sniff the content and headers of every page."
(Source: https://www.reddit.com/r/talesfromtechsupport/comments/7k7wu... )
The question is still: what was the goal?