logoalt Hacker News

FridgeSealyesterday at 10:17 PM3 repliesview on HN

So the follow up question, is why is a random website, allowed to try and load arbitrary files?


Replies

stingraycharlesyesterday at 10:25 PM

This is how I interpreted the original question and indeed it makes no sense, JavaScript from a website should not be allowed to interact with extensions like this.

show 2 replies
sigmoid10yesterday at 10:38 PM

Chrome exposes these files via a URL that you can fetch in javascript like you would any other file on a normal website. These local extension files usually contain code, styles or images that your browser needs to run the extensions.

show 1 reply
mschuster91yesterday at 10:54 PM

Because extensions can and often do contain stuff like images or JS bundles that they inject into a target page's DOM. Not allowing a tab's context to load files from the chrome-extension:// namespace would break a lot of things.