Hacker News Reader

A script loaded by a site needs to escape its sandbox. I assume an extension script is not in its own sandbox so it can read you banking details when you visit a banking website. I imagine they can read key presses so an extension can know your banking passwords.

View on HN

Which is why extensions also nowadays only served via a web store which has moderation policies and moderators which look for this kind of stuff.

The Chrome Web Store is functionally a malware distribution system. There's no real moderation to speak of, and the vast majority of desktop PC malware is distributed by it.

Reply on news.ycombinator.com