<story><title>Button Stealer</title><url>https://anatolyzenkov.com/stolen-buttons/button-stealer</url></story><parent_chain></parent_chain><comment><author>purple-leafy</author><text>Issue with this “benign” extension is that it will be using&lt;p&gt;“host_permissions”: “&amp;lt;all_urls&amp;gt;”&lt;p&gt;In its manifest means it can basically do anything on any webpage you visit, scrape data etc.&lt;p&gt;As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous</text></comment>
<story><title>Button Stealer</title><url>https://anatolyzenkov.com/stolen-buttons/button-stealer</url></story><parent_chain></parent_chain><comment><author>Hamuko</author><text>I&amp;#x27;d be worried about installing these sorts of extensions in case someone decides to offer the developer a lucrative amount of money to buy it and then uses it for less-than-fun purposes. Not sure if they&amp;#x27;d need additional permissions for it, but at least the current content script is ran against &amp;quot;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;*&amp;#x2F;\&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;*&amp;#x2F;\&lt;/a&gt;*&amp;quot; already.</text></comment>