patrickkettner/manifest.json Secret

## manifest.json
{
  "name": "insecure download issue",
  "version": "1.0",
  "manifest_version": 3,
  "action": {
    "default_popup": "popup.html"
  }
}

## popup.html
<!DOCTYPE html>
<html lang="en">
  <body>
    <button>download</button>
    <script src="popup.js"></script>
  </body>
</html>

## popup.js
const btn = document.querySelector('button');
btn.addEventListener('click', download)

function download(m_a, data) {
  const lnk = document.createElement("a");
  let file = new Blob([''], { type: 'plain/txt' });
  lnk.href = URL.createObjectURL(file);
  lnk.click()
}
	{
	"name": "insecure download issue",
	"version": "1.0",
	"manifest_version": 3,
	"action": {
	"default_popup": "popup.html"
	}
	}