DOMContentLoaded listener in popup-frame-script.js needs to check that the window has the expected URL, or at least to unregister itself after the first response, so that it doesn't wind up injecting a privileged function into a remote document if the window somehow navigates somewhere unexpected.
(from AMO review)
Honza
DOMContentLoaded listener in popup-frame-script.js needs to check that the window has the expected URL, or at least to unregister itself after the first response, so that it doesn't wind up injecting a privileged function into a remote document if the window somehow navigates somewhere unexpected.
(from AMO review)
Honza