Hacker News Reader

This extension only requests access to HN's known domains.

If one would try to request to a non white-listed domain it would trigger Access-Control-Allow-Origin error.

Also I think v3 makes it quite hard to use remote loaded code.

Any attempt to be malicious would probably be caught by store's review process eventually.

Yeah, I'm not saying this extension is doing anything nefarious. I am saying that Google's propaganda about MV3 isn't right, and it's obviously spilling out to other people. MV3 blocks one specific api call in OnBeforeRequest()...the one that's useful mostly to ad blockers. The remote loaded code restriction is laudable, but the review process is weak. It's fairly easy to get shady things approved.

Manifest V3 prohibits extensions from loading any remote code like JavaScript or Wasm files[1].

1. https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...

Right, I acknowledged that in the comment you're replying to. But the review process is weak. And, I don't need to load external code to exfiltrate stuff. For example, I can load an image with a specific name/path, or hijack functionality already on the page, like Google Analytics code. Generally, non-trivial extensions cannot be both secure and useful at the same time.

Reply on news.ycombinator.com