AutoPause icon indicating copy to clipboard operation
AutoPause copied to clipboard

Extension Security Audit (ESA)

Open NDevTK opened this issue 11 months ago • 2 comments

This extension allows websites to pause, mute, resume and detect audible media cross-origin. This is a trade-off for functionality but it needs to be reviewed what's possible from an evil content script to ensure there's always a valid justification. For example the tabFocus, ignoreTab message allowing document pip support should not exist and is likely going to be abuseable.

Permission requests promotes <all_urls> usage hopefully Ask for permission to run on audible tabs might work as a replacement when the API is ready (not crashing).

NDevTK avatar Apr 27 '25 15:04 NDevTK

Oh and no bug bounty program like WTF.

NDevTK avatar Apr 27 '25 15:04 NDevTK

ignoreTab has been removed and the event checks for tabFocus are stricter. Worth saying the tab focus message does not focus the tab it only affects media playback.

NDevTK avatar May 07 '25 02:05 NDevTK