The host is missing an important security update according to Mozilla advisory, MFSA2016-46. The update is required to fix a cross-site scripting (XSS) vulnerability. A flaw is present in the chrome.tabs.update API for web extensions, which allows for navigation to javascript: URLs without additional permissions. Successful exploitation allows remote attackers to elevate privilege for a universal ...