Re:Grammarly shared its tokens with all websites
by paulryanrogers on Tuesday February 06, 2018 @02:55PM
(#16319007)
I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.
Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data.
People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.