Is it safe to use an untrusted bookmarklet on a web page containing sensitive data, for example internet banking page? In particular, can a bookmarklet send the data anywhere or execute some actions (like following links) on the page?
migrated from stackoverflow.com Jan 23 at 20:08
This question came from our site for professional and enthusiast programmers.
No, it is not safe.
A bookmarklet can see everything on the page, read its cookies and its local storage, and interact with the server the page came from (and I even think other servers as well, as the cross-domain-sandboxing may not apply to bookmarklets).