Hacker News Reader

This permission is harmless because native messaging only allows an extension to communicate with a specific native companion program that has to be installed/enabled outside if firefox.

If you don't install the companion program, this permission won't do anything.

It does not allow the extension to run arbitrary programs.

View on HN

Where and how is this program specified? Can malware impersonate itself as a "companion program" and collect user activity data?

It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running on your computer I suppose it could do that (assuming the messages sent by the extension contain browsing data) but there would probably be easier ways for it to collect your data.

The permission request should probably be reworded to make that more clear.

Reply on news.ycombinator.com