dragongirlsnout

xray vision is one of the stupidest things to have to account for in webdev. yeah i guess it makes sense why you can't XHR something from the api and use it to set a property in a script running in a slightly less privileged context but a) the content script in question already HAS enough same-origin privilege to access authorized api methods and b) it rarely ever matters because if you aren't setting object properties directly from the xrayed object you can do literally anything you want with it