Content-world userscripts currently run as trusted extension-world code, with access to browser.runtime. GM wrappers are not a sandbox against a malicious installed or remotely updated script.
This predates #780: main at 665f7abc already executed @inject-into content scripts through new Function in that world. The R01 fix in #780 removes page-script access to generic native GM bridges; it does not create isolation between installed scripts and the extension itself.
A separate hardening change should put installed scripts in a genuine compartment without ambient extension APIs, provide script-bound GM capabilities, and bind content-originated native relays to their permitted frame/site. Verify constructor, prototype and cross-frame escapes as well as attempts to mutate another script's storage or extension-wide settings. Shadowing browser as a function argument alone is not sufficient.
The sandbox must retain DOM access and supported Safari compatibility. This needs an architectural change, not another page-visible token. See the security review.
Content-world userscripts currently run as trusted extension-world code, with access to
browser.runtime. GM wrappers are not a sandbox against a malicious installed or remotely updated script.This predates #780: main at
665f7abcalready executed@inject-into contentscripts throughnew Functionin that world. The R01 fix in #780 removes page-script access to generic native GM bridges; it does not create isolation between installed scripts and the extension itself.A separate hardening change should put installed scripts in a genuine compartment without ambient extension APIs, provide script-bound GM capabilities, and bind content-originated native relays to their permitted frame/site. Verify constructor, prototype and cross-frame escapes as well as attempts to mutate another script's storage or extension-wide settings. Shadowing
browseras a function argument alone is not sufficient.The sandbox must retain DOM access and supported Safari compatibility. This needs an architectural change, not another page-visible token. See the security review.