alt Hacker NewsThis is a security vulnerability and should be patched. Sorry, LinkedIn.
(Alternatively extension developers can modify their extensions to block these requests!)
Replies
MrGilbert • yesterday at 8:41 PM
I'm not sure how you'd patch that. Any request that’s made from the current open tab / window is made on behalf of the user. From my point of view, it's impossible for the browser to know, if the request is legit or not.
➕ show 1 reply
toomuchtodo • yesterday at 8:25 PM
Is there no browser setting to defend against this attack? If not, there should be, versus relying on extension authors to configure or enable such a setting.
➕ show 1 reply
No kidding. I am shocked this works.
Does Firefox have a similar weakness?