Reply to thread

Message

<blockquote data-quote="Vitali Ortzi" data-source="post: 1117945" data-attributes="member: 57714">There is a lot of reduction in Attack surface but yes there is definitely a long way to go and worst of all a malicious actor can still publish malicious extension as google own vetting isn&#039;t great and the abuses above are malicious intent and mv3 doesn&#039;t deal with malicious intent rather tries to reduce attack surface from outside actors by having far lower attack surface So the benefits are mainly against a malicious external actor like a malicious site 1. Background pages replaced with&nbsp; service workers 2.google now Enforces script-src &#039;self&#039; and doesn&#039;t allow unsafe-inline and unsafe-eval 3 more aggressive permissions over Firefox if I remember correctly 4. Web request API is banned and you can only use declarativeNetRequest 5. UUID randomizationAnd a&nbsp; few others&nbsp; u can look for in the docs</blockquote>

[QUOTE="Vitali Ortzi, post: 1117945, member: 57714"] There is a lot of reduction in Attack surface but yes there is definitely a long way to go and worst of all a malicious actor can still publish malicious extension as google own vetting isn't great and the abuses above are malicious intent and mv3 doesn't deal with malicious intent rather tries to reduce attack surface from outside actors by having far lower attack surface So the benefits are mainly against a malicious external actor like a malicious site 1. Background pages replaced with service workers 2.google now Enforces script-src 'self' and doesn't allow unsafe-inline and unsafe-eval 3 more aggressive permissions over Firefox if I remember correctly 4. Web request API is banned and you can only use declarativeNetRequest 5. UUID randomization And a few others u can look for in the docs [/QUOTE]

Verification