Alarming. Same origin policy not strong enough. I suppose a lot of extensions may be similarly vulnerable.