News for hackers. Stuff that matters.
Re:LinkedIn scans for 6,278 extensions and encrypts the resu... by mschuster91 on Thursday April 30, 2026 @06:54PM (#47969331)
Because extensions can and often do contain stuff like images or JS bundles that they inject into a target page's DOM. Not allowing a tab's context to load files from the chrome-extension:// namespace would break a lot of things.
Re:LinkedIn scans for 6,278 extensions and encrypts the resu... by unglaublich on Friday May 01, 2026 @01:48AM (#47971631)
True, but you'd expect the same CORS rules to apply for extensions. Only pages originating from an extension are by default able to load resources from said extension.