Re:LinkedIn scans for 6,278 extensions and encrypts the resu...
by mschuster91 on Thursday April 30, 2026 @06:54PM
(#47969331)
Because extensions can and often do contain stuff like images or JS bundles that they inject into a target page's DOM. Not allowing a tab's context to load files from the chrome-extension:// namespace would break a lot of things.
[ Parent
| on HN ]
Re:LinkedIn scans for 6,278 extensions and encrypts the resu...
by unglaublich on Friday May 01, 2026 @01:48AM
(#47971631)
True, but you'd expect the same CORS rules to apply for extensions.
Only pages originating from an extension are by default able to load resources from said extension.