News for hackers. Stuff that matters.

A comment on LinkedIn scans for 6,278 extensions and encrypts the results into every request. Parent comment

Re:LinkedIn scans for 6,278 extensions and encrypts the resu... by pbhjpbhj on Friday May 01, 2026 @11:07AM (#47975682)
From the other end, yes extensions access all page data, but pages shouldn't access extension data at all; it feels like that should be the CORS violation.
[ Parent | on HN ]
Re:LinkedIn scans for 6,278 extensions and encrypts the resu... by sigmoid10 on Friday May 01, 2026 @12:31PM (#47976701)
You have it backwards. For an extension to work on a page, it's data/code needs to be accessible from said page. If your extension server in chrome enforced CORS to prevent access from tabs on other websites, extensions wouldn't work anywhere.
[ Parent | on HN ]