@Rhababerbarbar @simon Well, I think it's related :-) Yes, the research/blog post was triggered by a bug in content-scripts handling in Chrome. It also explains how Firefox is adding extra permissions using a permissionsmanager for some of its features (in contrast to a hidden web extension, as Chrome appears to be doing here).