chrome:window.external leaks global object + allows cross origin script access

We use a static local for the External object But that both leaks the entire global object in the wrapper stored inside the External and also means that doing: js // main page. window.external.foo = function alert1 document.body.innerHTML = "" // inside example.com: window.external.foo // alert...