Comment by arkadiyt

This extension is trivially vulnerable to XSS - anyone can write javascript in their HN bio and it will execute in your logged-in context if you mouse over their profile. Here's the relevant code:

https://github.com/mudulo/hncard/blob/master/chrome/js/hnpro...