This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please see the following link for instructions on filing security bugs:
http://www.chromium.org/Home/chromium-security/reporting-security-bugs


VULNERABILITY DETAILS
Please provide a brief explanation of the security issue.

VERSION
Chrome Version: 51.0.2704.47 + beta / 50.0.2661.102 + stable
Operating System: Ubuntu 16.04 / OS X 10.11.4

REPRODUCTION CASE
Malicious Chrome extensions can be illegally request under the guise of the user.
Example:
- Cookie required request
- Get a token that was stored in the Web Storage. Request using it
- More unintended requests by users 

code:
This is a dangerous code that can run on 'inbox.google.com'.

```
fetch( '/', { mode: 'cors', credentials: 'include' } ).then( ( res ) => { return res.text() } ).then( ( text ) => { console.log( text ) } )
```

This code only get the HTML. However, various request for authentication would be achieved.

I worry it would might be a XSS.
 

Deleted: chrome-extension-fetch-example.zip 937 bytes

chrome-extension-fetch-example.zip 937 bytes Download