Tabs in general should be security boundaries. Anything else should propmt for permission.