Eliminating XSS from WebUI with Trusted Types

After the research on Site Isolation, it became clear that the most common problem with extensions is calling chrome.tabs.create with a URL received from a content script message. While such a bug can be used to steal local files, it can also open up an interesting attack surface, which is the navigation to WebUI. In this blog post, we will review a few vulnerabilities in WebUI, followed by a few