Let's build a Chrome extension that steals as much data as possible
> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions.An egregious and nearly unbelievable oversight on Google's part. :-\As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure things look and operate as expected.  Especially for a security sensitive UI element.The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years.There are so many risk-reduction controls in place; tons of red tape and umpteen security and privacy reviews required to ship even minor features or updates, yet here we are.How many hands have been in the pot and not noticed/raised/resolved what amounts to a pretty obvious security vulnerability?  And if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open?The author deserves the highest tier of bug bounty reward for bringing this to light.  What's that?  It wasn't submitted through the proper channels to be eligible?  Right.