user 27f16191b4 fix(L4): use location.origin for postMessage, one-shot UUID listener ...

- Content script sends UUID via location.origin instead of "*"
- Inpage UUID listener removes itself after first message to prevent
  malicious pages from overriding the persisted UUID

2026-02-27 11:58:57 -08:00

6.0 KiB

Raw Blame History

View Raw