Interesting. I didn't know a extension’s web-accessible resource (e.g. chrome-extension://<id>/...) could be abused to learn about the user's installed extensions by checking whether it resolves or not.

▲

davidmurdoch 6 hours ago | parent [-]

You would need to use use_dynamic_url: true in the manifest to create a unique one.

	▲	acorn221 6 hours ago \| parent \| next [-]
		Yeah, this is the easiest way to get around it
	▲	philipwhiuk 6 hours ago \| parent \| prev [-]
		Or just not allow them to load the URIs at all