User scripts have super wide permissions. For example a user script scoped to YouTube.com can make payments from any cards you have saved in Google pay.
And most user scripts are so long a typical user won't be able to spot a couple of malicious lines amongst 10k lines of minified webpacked libraries.
And most user scripts are so long a typical user won't be able to spot a couple of malicious lines amongst 10k lines of minified webpacked libraries.