News for hackers. Stuff that matters.

A comment on More on DataSpii: How extensions hide their grabs and how they’re discovered. Parent comment

Re:More on DataSpii: How extensions hide their grabs and how... by smilliken on Thursday July 18, 2019 @02:35PM (#20472717)
Is it possible to prevent an extension from downloading a javascript payload and interpreting it? Eval isn't required.
[ Parent | on HN ]
Re:More on DataSpii: How extensions hide their grabs and how... by gorhill on Thursday July 18, 2019 @03:24PM (#20473118)
The default `script-src` policy in extensions is 'self', no JavaScript code outside the package will be allowed to execute.
[ Parent | on HN ]